source3/registry/regfio.c

   1 /*
   2  * Unix SMB/CIFS implementation.
   3  * Windows NT registry I/O library
   4  * Copyright (c) Gerald (Jerry) Carter               2005
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include "regfio.h"
  23 #include "../librpc/gen_ndr/ndr_security.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_REGISTRY
  27
  28 /*******************************************************************
  29  *
  30  * TODO : Right now this code basically ignores classnames.
  31  *
  32  ******************************************************************/
  33
  34 #if defined(PARANOID_MALLOC_CHECKER)
  35 #define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem_((ps),sizeof(type),(count))
  36 #else
  37 #define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem((ps),sizeof(type),(count))
  38 #endif
  39
  40 /*******************************************************************
  41  Reads or writes an NTTIME structure.
  42 ********************************************************************/
  43
  44 static bool smb_io_time(const char *desc, NTTIME *nttime, prs_struct *ps, int depth)
  45 {
  46         uint32 low, high;
  47         if (nttime == NULL)
  48                 return False;
  49
  50         prs_debug(ps, depth, desc, "smb_io_time");
  51         depth++;
  52
  53         if(!prs_align(ps))
  54                 return False;
  55
  56         if (MARSHALLING(ps)) {
  57                 low = *nttime & 0xFFFFFFFF;
  58                 high = *nttime >> 32;
  59         }
  60
  61         if(!prs_uint32("low ", ps, depth, &low)) /* low part */
  62                 return False;
  63         if(!prs_uint32("high", ps, depth, &high)) /* high part */
  64                 return False;
  65
  66         if (UNMARSHALLING(ps)) {
  67                 *nttime = (((uint64_t)high << 32) + low);
  68         }
  69
  70         return True;
  71 }
  72
  73 /*******************************************************************
  74 *******************************************************************/
  75
  76 static int write_block( REGF_FILE *file, prs_struct *ps, uint32 offset )
  77 {
  78         int bytes_written, returned;
  79         char *buffer = prs_data_p( ps );
  80         uint32 buffer_size = prs_data_size( ps );
  81         SMB_STRUCT_STAT sbuf;
  82
  83         if ( file->fd == -1 )
  84                 return -1;
  85
  86         /* check for end of file */
  87
  88         if (sys_fstat(file->fd, &sbuf, false)) {
  89                 DEBUG(0,("write_block: stat() failed! (%s)\n", strerror(errno)));
  90                 return -1;
  91         }
  92
  93         if ( lseek( file->fd, offset, SEEK_SET ) == -1 ) {
  94                 DEBUG(0,("write_block: lseek() failed! (%s)\n", strerror(errno) ));
  95                 return -1;
  96         }
  97
  98         bytes_written = returned = 0;
  99         while ( bytes_written < buffer_size ) {
 100                 if ( (returned = write( file->fd, buffer+bytes_written, buffer_size-bytes_written )) == -1 ) {
 101                         DEBUG(0,("write_block: write() failed! (%s)\n", strerror(errno) ));
 102                         return False;
 103                 }
 104
 105                 bytes_written += returned;
 106         }
 107
 108         return bytes_written;
 109 }
 110
 111 /*******************************************************************
 112 *******************************************************************/
 113
 114 static int read_block( REGF_FILE *file, prs_struct *ps, uint32 file_offset, uint32 block_size )
 115 {
 116         int bytes_read, returned;
 117         char *buffer;
 118         SMB_STRUCT_STAT sbuf;
 119
 120         /* check for end of file */
 121
 122         if (sys_fstat(file->fd, &sbuf, false)) {
 123                 DEBUG(0,("read_block: stat() failed! (%s)\n", strerror(errno)));
 124                 return -1;
 125         }
 126
 127         if ( (size_t)file_offset >= sbuf.st_ex_size )
 128                 return -1;
 129
 130         /* if block_size == 0, we are parsing HBIN records and need
 131            to read some of the header to get the block_size from there */
 132
 133         if ( block_size == 0 ) {
 134                 char hdr[0x20];
 135
 136                 if ( lseek( file->fd, file_offset, SEEK_SET ) == -1 ) {
 137                         DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno) ));
 138                         return -1;
 139                 }
 140
 141                 returned = read( file->fd, hdr, 0x20 );
 142                 if ( (returned == -1) || (returned < 0x20) ) {
 143                         DEBUG(0,("read_block: failed to read in HBIN header. Is the file corrupt?\n"));
 144                         return -1;
 145                 }
 146
 147                 /* make sure this is an hbin header */
 148
 149                 if ( strncmp( hdr, "hbin", HBIN_HDR_SIZE ) != 0 ) {
 150                         DEBUG(0,("read_block: invalid block header!\n"));
 151                         return -1;
 152                 }
 153
 154                 block_size = IVAL( hdr, 0x08 );
 155         }
 156
 157         DEBUG(10,("read_block: block_size == 0x%x\n", block_size ));
 158
 159         /* set the offset, initialize the buffer, and read the block from disk */
 160
 161         if ( lseek( file->fd, file_offset, SEEK_SET ) == -1 ) {
 162                 DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno) ));
 163                 return -1;
 164         }
 165
 166         if (!prs_init( ps, block_size, file->mem_ctx, UNMARSHALL )) {
 167                 DEBUG(0,("read_block: prs_init() failed! (%s)\n", strerror(errno) ));
 168                 return -1;
 169         }
 170         buffer = prs_data_p( ps );
 171         bytes_read = returned = 0;
 172
 173         while ( bytes_read < block_size ) {
 174                 if ( (returned = read( file->fd, buffer+bytes_read, block_size-bytes_read )) == -1 ) {
 175                         DEBUG(0,("read_block: read() failed (%s)\n", strerror(errno) ));
 176                         return False;
 177                 }
 178                 if ( (returned == 0) && (bytes_read < block_size) ) {
 179                         DEBUG(0,("read_block: not a vald registry file ?\n" ));
 180                         return False;
 181                 }
 182
 183                 bytes_read += returned;
 184         }
 185
 186         return bytes_read;
 187 }
 188
 189 /*******************************************************************
 190 *******************************************************************/
 191
 192 static bool write_hbin_block( REGF_FILE *file, REGF_HBIN *hbin )
 193 {
 194         if ( !hbin->dirty )
 195                 return True;
 196
 197         /* write free space record if any is available */
 198
 199         if ( hbin->free_off != REGF_OFFSET_NONE ) {
 200                 uint32 header = 0xffffffff;
 201
 202                 if ( !prs_set_offset( &hbin->ps, hbin->free_off-sizeof(uint32) ) )
 203                         return False;
 204                 if ( !prs_uint32( "free_size", &hbin->ps, 0, &hbin->free_size ) )
 205                         return False;
 206                 if ( !prs_uint32( "free_header", &hbin->ps, 0, &header ) )
 207                         return False;
 208         }
 209
 210         hbin->dirty = (write_block( file, &hbin->ps, hbin->file_off ) != -1);
 211
 212         return hbin->dirty;
 213 }
 214
 215 /*******************************************************************
 216 *******************************************************************/
 217
 218 static bool hbin_block_close( REGF_FILE *file, REGF_HBIN *hbin )
 219 {
 220         REGF_HBIN *p;
 221
 222         /* remove the block from the open list and flush it to disk */
 223
 224         for ( p=file->block_list; p && p!=hbin; p=p->next )
 225                 ;;
 226
 227         if ( p == hbin ) {
 228                 DLIST_REMOVE( file->block_list, hbin );
 229         }
 230         else
 231                 DEBUG(0,("hbin_block_close: block not in open list!\n"));
 232
 233         if ( !write_hbin_block( file, hbin ) )
 234                 return False;
 235
 236         return True;
 237 }
 238
 239 /*******************************************************************
 240 *******************************************************************/
 241
 242 static bool prs_regf_block( const char *desc, prs_struct *ps, int depth, REGF_FILE *file )
 243 {
 244         prs_debug(ps, depth, desc, "prs_regf_block");
 245         depth++;
 246
 247         if ( !prs_uint8s( True, "header", ps, depth, (uint8*)file->header, sizeof( file->header )) )
 248                 return False;
 249
 250         /* yes, these values are always identical so store them only once */
 251
 252         if ( !prs_uint32( "unknown1", ps, depth, &file->unknown1 ))
 253                 return False;
 254         if ( !prs_uint32( "unknown1 (again)", ps, depth, &file->unknown1 ))
 255                 return False;
 256
 257         /* get the modtime */
 258
 259         if ( !prs_set_offset( ps, 0x0c ) )
 260                 return False;
 261         if ( !smb_io_time( "modtime", &file->mtime, ps, depth ) )
 262                 return False;
 263
 264         /* constants */
 265
 266         if ( !prs_uint32( "unknown2", ps, depth, &file->unknown2 ))
 267                 return False;
 268         if ( !prs_uint32( "unknown3", ps, depth, &file->unknown3 ))
 269                 return False;
 270         if ( !prs_uint32( "unknown4", ps, depth, &file->unknown4 ))
 271                 return False;
 272         if ( !prs_uint32( "unknown5", ps, depth, &file->unknown5 ))
 273                 return False;
 274
 275         /* get file offsets */
 276
 277         if ( !prs_set_offset( ps, 0x24 ) )
 278                 return False;
 279         if ( !prs_uint32( "data_offset", ps, depth, &file->data_offset ))
 280                 return False;
 281         if ( !prs_uint32( "last_block", ps, depth, &file->last_block ))
 282                 return False;
 283
 284         /* one more constant */
 285
 286         if ( !prs_uint32( "unknown6", ps, depth, &file->unknown6 ))
 287                 return False;
 288
 289         /* get the checksum */
 290
 291         if ( !prs_set_offset( ps, 0x01fc ) )
 292                 return False;
 293         if ( !prs_uint32( "checksum", ps, depth, &file->checksum ))
 294                 return False;
 295
 296         return True;
 297 }
 298
 299 /*******************************************************************
 300 *******************************************************************/
 301
 302 static bool prs_hbin_block( const char *desc, prs_struct *ps, int depth, REGF_HBIN *hbin )
 303 {
 304         uint32 block_size2;
 305
 306         prs_debug(ps, depth, desc, "prs_regf_block");
 307         depth++;
 308
 309         if ( !prs_uint8s( True, "header", ps, depth, (uint8*)hbin->header, sizeof( hbin->header )) )
 310                 return False;
 311
 312         if ( !prs_uint32( "first_hbin_off", ps, depth, &hbin->first_hbin_off ))
 313                 return False;
 314
 315         /* The dosreg.cpp comments say that the block size is at 0x1c.
 316            According to a WINXP NTUSER.dat file, this is wrong.  The block_size
 317            is at 0x08 */
 318
 319         if ( !prs_uint32( "block_size", ps, depth, &hbin->block_size ))
 320                 return False;
 321
 322         block_size2 = hbin->block_size;
 323         prs_set_offset( ps, 0x1c );
 324         if ( !prs_uint32( "block_size2", ps, depth, &block_size2 ))
 325                 return False;
 326
 327         if ( MARSHALLING(ps) )
 328                 hbin->dirty = True;
 329
 330
 331         return True;
 332 }
 333
 334 /*******************************************************************
 335 *******************************************************************/
 336
 337 static bool prs_nk_rec( const char *desc, prs_struct *ps, int depth, REGF_NK_REC *nk )
 338 {
 339         uint16 class_length, name_length;
 340         uint32 start;
 341         uint32 data_size, start_off, end_off;
 342         uint32 unknown_off = REGF_OFFSET_NONE;
 343
 344         nk->hbin_off = prs_offset( ps );
 345         start = nk->hbin_off;
 346
 347         prs_debug(ps, depth, desc, "prs_nk_rec");
 348         depth++;
 349
 350         /* back up and get the data_size */
 351
 352         if ( !prs_set_offset( ps, prs_offset(ps)-sizeof(uint32)) )
 353                 return False;
 354         start_off = prs_offset( ps );
 355         if ( !prs_uint32( "rec_size", ps, depth, &nk->rec_size ))
 356                 return False;
 357
 358         if ( !prs_uint8s( True, "header", ps, depth, (uint8*)nk->header, sizeof( nk->header )) )
 359                 return False;
 360
 361         if ( !prs_uint16( "key_type", ps, depth, &nk->key_type ))
 362                 return False;
 363         if ( !smb_io_time( "mtime", &nk->mtime, ps, depth ))
 364                 return False;
 365
 366         if ( !prs_set_offset( ps, start+0x0010 ) )
 367                 return False;
 368         if ( !prs_uint32( "parent_off", ps, depth, &nk->parent_off ))
 369                 return False;
 370         if ( !prs_uint32( "num_subkeys", ps, depth, &nk->num_subkeys ))
 371                 return False;
 372
 373         if ( !prs_set_offset( ps, start+0x001c ) )
 374                 return False;
 375         if ( !prs_uint32( "subkeys_off", ps, depth, &nk->subkeys_off ))
 376                 return False;
 377         if ( !prs_uint32( "unknown_off", ps, depth, &unknown_off) )
 378                 return False;
 379
 380         if ( !prs_set_offset( ps, start+0x0024 ) )
 381                 return False;
 382         if ( !prs_uint32( "num_values", ps, depth, &nk->num_values ))
 383                 return False;
 384         if ( !prs_uint32( "values_off", ps, depth, &nk->values_off ))
 385                 return False;
 386         if ( !prs_uint32( "sk_off", ps, depth, &nk->sk_off ))
 387                 return False;
 388         if ( !prs_uint32( "classname_off", ps, depth, &nk->classname_off ))
 389                 return False;
 390
 391         if ( !prs_uint32( "max_bytes_subkeyname", ps, depth, &nk->max_bytes_subkeyname))
 392                 return False;
 393         if ( !prs_uint32( "max_bytes_subkeyclassname", ps, depth, &nk->max_bytes_subkeyclassname))
 394                 return False;
 395         if ( !prs_uint32( "max_bytes_valuename", ps, depth, &nk->max_bytes_valuename))
 396                 return False;
 397         if ( !prs_uint32( "max_bytes_value", ps, depth, &nk->max_bytes_value))
 398                 return False;
 399         if ( !prs_uint32( "unknown index", ps, depth, &nk->unk_index))
 400                 return False;
 401
 402         name_length = nk->keyname ? strlen(nk->keyname) : 0 ;
 403         class_length = nk->classname ? strlen(nk->classname) : 0 ;
 404         if ( !prs_uint16( "name_length", ps, depth, &name_length ))
 405                 return False;
 406         if ( !prs_uint16( "class_length", ps, depth, &class_length ))
 407                 return False;
 408
 409         if ( class_length ) {
 410                 ;;
 411         }
 412
 413         if ( name_length ) {
 414                 if ( UNMARSHALLING(ps) ) {
 415                         if ( !(nk->keyname = PRS_ALLOC_MEM( ps, char, name_length+1 )) )
 416                                 return False;
 417                 }
 418
 419                 if ( !prs_uint8s( True, "name", ps, depth, (uint8*)nk->keyname, name_length) )
 420                         return False;
 421
 422                 if ( UNMARSHALLING(ps) )
 423                         nk->keyname[name_length] = '\0';
 424         }
 425
 426         end_off = prs_offset( ps );
 427
 428         /* data_size must be divisible by 8 and large enough to hold the original record */
 429
 430         data_size = ((start_off - end_off) & 0xfffffff8 );
 431         if ( data_size > nk->rec_size )
 432                 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, nk->rec_size));
 433
 434         if ( MARSHALLING(ps) )
 435                 nk->hbin->dirty = True;
 436
 437         return True;
 438 }
 439
 440 /*******************************************************************
 441 *******************************************************************/
 442
 443 static uint32 regf_block_checksum( prs_struct *ps )
 444 {
 445         char *buffer = prs_data_p( ps );
 446         uint32 checksum, x;
 447         int i;
 448
 449         /* XOR of all bytes 0x0000 - 0x01FB */
 450
 451         checksum = x = 0;
 452
 453         for ( i=0; i<0x01FB; i+=4 ) {
 454                 x = IVAL(buffer, i );
 455                 checksum ^= x;
 456         }
 457
 458         return checksum;
 459 }
 460
 461 /*******************************************************************
 462 *******************************************************************/
 463
 464 static bool read_regf_block( REGF_FILE *file )
 465 {
 466         prs_struct ps;
 467         uint32 checksum;
 468
 469         /* grab the first block from the file */
 470
 471         if ( read_block( file, &ps, 0, REGF_BLOCKSIZE ) == -1 )
 472                 return False;
 473
 474         /* parse the block and verify the checksum */
 475
 476         if ( !prs_regf_block( "regf_header", &ps, 0, file ) )
 477                 return False;
 478
 479         checksum = regf_block_checksum( &ps );
 480
 481         prs_mem_free( &ps );
 482
 483         if ( file->checksum !=  checksum ) {
 484                 DEBUG(0,("read_regf_block: invalid checksum\n" ));
 485                 return False;
 486         }
 487
 488         return True;
 489 }
 490
 491 /*******************************************************************
 492 *******************************************************************/
 493
 494 static REGF_HBIN* read_hbin_block( REGF_FILE *file, off_t offset )
 495 {
 496         REGF_HBIN *hbin;
 497         uint32 record_size, curr_off, block_size, header;
 498
 499         if ( !(hbin = TALLOC_ZERO_P(file->mem_ctx, REGF_HBIN)) )
 500                 return NULL;
 501         hbin->file_off = offset;
 502         hbin->free_off = -1;
 503
 504         if ( read_block( file, &hbin->ps, offset, 0 ) == -1 )
 505                 return NULL;
 506
 507         if ( !prs_hbin_block( "hbin", &hbin->ps, 0, hbin ) )
 508                 return NULL;
 509
 510         /* this should be the same thing as hbin->block_size but just in case */
 511
 512         block_size = prs_data_size( &hbin->ps );
 513
 514         /* Find the available free space offset.  Always at the end,
 515            so walk the record list and stop when you get to the end.
 516            The end is defined by a record header of 0xffffffff.  The
 517            previous 4 bytes contains the amount of free space remaining
 518            in the hbin block. */
 519
 520         /* remember that the record_size is in the 4 bytes preceeding the record itself */
 521
 522         if ( !prs_set_offset( &hbin->ps, file->data_offset+HBIN_HDR_SIZE-sizeof(uint32) ) )
 523                 return False;
 524
 525         record_size = 0;
 526         header = 0;
 527         curr_off = prs_offset( &hbin->ps );
 528         while ( header != 0xffffffff ) {
 529                 /* not done yet so reset the current offset to the
 530                    next record_size field */
 531
 532                 curr_off = curr_off+record_size;
 533
 534                 /* for some reason the record_size of the last record in
 535                    an hbin block can extend past the end of the block
 536                    even though the record fits within the remaining
 537                    space....aaarrrgggghhhhhh */
 538
 539                 if ( curr_off >= block_size ) {
 540                         record_size = -1;
 541                         curr_off = -1;
 542                         break;
 543                 }
 544
 545                 if ( !prs_set_offset( &hbin->ps, curr_off) )
 546                         return False;
 547
 548                 if ( !prs_uint32( "rec_size", &hbin->ps, 0, &record_size ) )
 549                         return False;
 550                 if ( !prs_uint32( "header", &hbin->ps, 0, &header ) )
 551                         return False;
 552
 553                 SMB_ASSERT( record_size != 0 );
 554
 555                 if ( record_size & 0x80000000 ) {
 556                         /* absolute_value(record_size) */
 557                         record_size = (record_size ^ 0xffffffff) + 1;
 558                 }
 559         }
 560
 561         /* save the free space offset */
 562
 563         if ( header == 0xffffffff ) {
 564
 565                 /* account for the fact that the curr_off is 4 bytes behind the actual
 566                    record header */
 567
 568                 hbin->free_off = curr_off + sizeof(uint32);
 569                 hbin->free_size = record_size;
 570         }
 571
 572         DEBUG(10,("read_hbin_block: free space offset == 0x%x\n", hbin->free_off));
 573
 574         if ( !prs_set_offset( &hbin->ps, file->data_offset+HBIN_HDR_SIZE )  )
 575                 return False;
 576
 577         return hbin;
 578 }
 579
 580 /*******************************************************************
 581  Input a random offset and receive the corresponding HBIN
 582  block for it
 583 *******************************************************************/
 584
 585 static bool hbin_contains_offset( REGF_HBIN *hbin, uint32 offset )
 586 {
 587         if ( !hbin )
 588                 return False;
 589
 590         if ( (offset > hbin->first_hbin_off) && (offset < (hbin->first_hbin_off+hbin->block_size)) )
 591                 return True;
 592
 593         return False;
 594 }
 595
 596 /*******************************************************************
 597  Input a random offset and receive the corresponding HBIN
 598  block for it
 599 *******************************************************************/
 600
 601 static REGF_HBIN* lookup_hbin_block( REGF_FILE *file, uint32 offset )
 602 {
 603         REGF_HBIN *hbin = NULL;
 604         uint32 block_off;
 605
 606         /* start with the open list */
 607
 608         for ( hbin=file->block_list; hbin; hbin=hbin->next ) {
 609                 DEBUG(10,("lookup_hbin_block: address = 0x%x [0x%lx]\n", hbin->file_off, (unsigned long)hbin ));
 610                 if ( hbin_contains_offset( hbin, offset ) )
 611                         return hbin;
 612         }
 613
 614         if ( !hbin ) {
 615                 /* start at the beginning */
 616
 617                 block_off = REGF_BLOCKSIZE;
 618                 do {
 619                         /* cleanup before the next round */
 620                         if ( hbin )
 621                                 prs_mem_free( &hbin->ps );
 622
 623                         hbin = read_hbin_block( file, block_off );
 624
 625                         if ( hbin )
 626                                 block_off = hbin->file_off + hbin->block_size;
 627
 628                 } while ( hbin && !hbin_contains_offset( hbin, offset ) );
 629         }
 630
 631         if ( hbin )
 632                 DLIST_ADD( file->block_list, hbin );
 633
 634         return hbin;
 635 }
 636
 637 /*******************************************************************
 638 *******************************************************************/
 639
 640 static bool prs_hash_rec( const char *desc, prs_struct *ps, int depth, REGF_HASH_REC *hash )
 641 {
 642         prs_debug(ps, depth, desc, "prs_hash_rec");
 643         depth++;
 644
 645         if ( !prs_uint32( "nk_off", ps, depth, &hash->nk_off ))
 646                 return False;
 647         if ( !prs_uint8s( True, "keycheck", ps, depth, hash->keycheck, sizeof( hash->keycheck )) )
 648                 return False;
 649
 650         return True;
 651 }
 652
 653 /*******************************************************************
 654 *******************************************************************/
 655
 656 static bool hbin_prs_lf_records( const char *desc, REGF_HBIN *hbin, int depth, REGF_NK_REC *nk )
 657 {
 658         int i;
 659         REGF_LF_REC *lf = &nk->subkeys;
 660         uint32 data_size, start_off, end_off;
 661
 662         prs_debug(&hbin->ps, depth, desc, "prs_lf_records");
 663         depth++;
 664
 665         /* check if we have anything to do first */
 666
 667         if ( nk->num_subkeys == 0 )
 668                 return True;
 669
 670         /* move to the LF record */
 671
 672         if ( !prs_set_offset( &hbin->ps, nk->subkeys_off + HBIN_HDR_SIZE - hbin->first_hbin_off ) )
 673                 return False;
 674
 675         /* backup and get the data_size */
 676
 677         if ( !prs_set_offset( &hbin->ps, prs_offset(&hbin->ps)-sizeof(uint32)) )
 678                 return False;
 679         start_off = prs_offset( &hbin->ps );
 680         if ( !prs_uint32( "rec_size", &hbin->ps, depth, &lf->rec_size ))
 681                 return False;
 682
 683         if ( !prs_uint8s( True, "header", &hbin->ps, depth, (uint8*)lf->header, sizeof( lf->header )) )
 684                 return False;
 685
 686         if ( !prs_uint16( "num_keys", &hbin->ps, depth, &lf->num_keys))
 687                 return False;
 688
 689         if ( UNMARSHALLING(&hbin->ps) ) {
 690                 if (lf->num_keys) {
 691                         if ( !(lf->hashes = PRS_ALLOC_MEM( &hbin->ps, REGF_HASH_REC, lf->num_keys )) )
 692                                 return False;
 693                 } else {
 694                         lf->hashes = NULL;
 695                 }
 696         }
 697
 698         for ( i=0; i<lf->num_keys; i++ ) {
 699                 if ( !prs_hash_rec( "hash_rec", &hbin->ps, depth, &lf->hashes[i] ) )
 700                         return False;
 701         }
 702
 703         end_off = prs_offset( &hbin->ps );
 704
 705         /* data_size must be divisible by 8 and large enough to hold the original record */
 706
 707         data_size = ((start_off - end_off) & 0xfffffff8 );
 708         if ( data_size > lf->rec_size )
 709                 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, lf->rec_size));
 710
 711         if ( MARSHALLING(&hbin->ps) )
 712                 hbin->dirty = True;
 713
 714         return True;
 715 }
 716
 717 /*******************************************************************
 718 *******************************************************************/
 719
 720 static bool hbin_prs_sk_rec( const char *desc, REGF_HBIN *hbin, int depth, REGF_SK_REC *sk )
 721 {
 722         prs_struct *ps = &hbin->ps;
 723         uint16 tag = 0xFFFF;
 724         uint32 data_size, start_off, end_off;
 725
 726
 727         prs_debug(ps, depth, desc, "hbin_prs_sk_rec");
 728         depth++;
 729
 730         if ( !prs_set_offset( &hbin->ps, sk->sk_off + HBIN_HDR_SIZE - hbin->first_hbin_off ) )
 731                 return False;
 732
 733         /* backup and get the data_size */
 734
 735         if ( !prs_set_offset( &hbin->ps, prs_offset(&hbin->ps)-sizeof(uint32)) )
 736                 return False;
 737         start_off = prs_offset( &hbin->ps );
 738         if ( !prs_uint32( "rec_size", &hbin->ps, depth, &sk->rec_size ))
 739                 return False;
 740
 741         if ( !prs_uint8s( True, "header", ps, depth, (uint8*)sk->header, sizeof( sk->header )) )
 742                 return False;
 743         if ( !prs_uint16( "tag", ps, depth, &tag))
 744                 return False;
 745
 746         if ( !prs_uint32( "prev_sk_off", ps, depth, &sk->prev_sk_off))
 747                 return False;
 748         if ( !prs_uint32( "next_sk_off", ps, depth, &sk->next_sk_off))
 749                 return False;
 750         if ( !prs_uint32( "ref_count", ps, depth, &sk->ref_count))
 751                 return False;
 752         if ( !prs_uint32( "size", ps, depth, &sk->size))
 753                 return False;
 754
 755         {
 756                 NTSTATUS status;
 757                 TALLOC_CTX *mem_ctx = prs_get_mem_context(&hbin->ps);
 758                 DATA_BLOB blob;
 759
 760                 if (MARSHALLING(&hbin->ps)) {
 761                         status = marshall_sec_desc(mem_ctx,
 762                                                    sk->sec_desc,
 763                                                    &blob.data, &blob.length);
 764                         if (!NT_STATUS_IS_OK(status))
 765                                 return False;
 766                         if (!prs_copy_data_in(&hbin->ps, (const char *)blob.data, blob.length))
 767                                 return False;
 768                 } else {
 769                         blob = data_blob_const(prs_data_p(&hbin->ps),
 770                                                prs_data_size(&hbin->ps));
 771                         status = unmarshall_sec_desc(mem_ctx,
 772                                                      blob.data, blob.length,
 773                                                      &sk->sec_desc);
 774                         if (!NT_STATUS_IS_OK(status))
 775                                 return False;
 776                         prs_set_offset(&hbin->ps, blob.length);
 777                 }
 778         }
 779
 780         end_off = prs_offset( &hbin->ps );
 781
 782         /* data_size must be divisible by 8 and large enough to hold the original record */
 783
 784         data_size = ((start_off - end_off) & 0xfffffff8 );
 785         if ( data_size > sk->rec_size )
 786                 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, sk->rec_size));
 787
 788         if ( MARSHALLING(&hbin->ps) )
 789                 hbin->dirty = True;
 790
 791         return True;
 792 }
 793
 794 /*******************************************************************
 795 *******************************************************************/
 796
 797 static bool hbin_prs_vk_rec( const char *desc, REGF_HBIN *hbin, int depth, REGF_VK_REC *vk, REGF_FILE *file )
 798 {
 799         uint32 offset;
 800         uint16 name_length;
 801         prs_struct *ps = &hbin->ps;
 802         uint32 data_size, start_off, end_off;
 803
 804         prs_debug(ps, depth, desc, "prs_vk_rec");
 805         depth++;
 806
 807         /* backup and get the data_size */
 808
 809         if ( !prs_set_offset( &hbin->ps, prs_offset(&hbin->ps)-sizeof(uint32)) )
 810                 return False;
 811         start_off = prs_offset( &hbin->ps );
 812         if ( !prs_uint32( "rec_size", &hbin->ps, depth, &vk->rec_size ))
 813                 return False;
 814
 815         if ( !prs_uint8s( True, "header", ps, depth, (uint8*)vk->header, sizeof( vk->header )) )
 816                 return False;
 817
 818         if ( MARSHALLING(&hbin->ps) )
 819                 name_length = strlen(vk->valuename);
 820
 821         if ( !prs_uint16( "name_length", ps, depth, &name_length ))
 822                 return False;
 823         if ( !prs_uint32( "data_size", ps, depth, &vk->data_size ))
 824                 return False;
 825         if ( !prs_uint32( "data_off", ps, depth, &vk->data_off ))
 826                 return False;
 827         if ( !prs_uint32( "type", ps, depth, &vk->type))
 828                 return False;
 829         if ( !prs_uint16( "flag", ps, depth, &vk->flag))
 830                 return False;
 831
 832         offset = prs_offset( ps );
 833         offset += 2;    /* skip 2 bytes */
 834         prs_set_offset( ps, offset );
 835
 836         /* get the name */
 837
 838         if ( vk->flag&VK_FLAG_NAME_PRESENT ) {
 839
 840                 if ( UNMARSHALLING(&hbin->ps) ) {
 841                         if ( !(vk->valuename = PRS_ALLOC_MEM( ps, char, name_length+1 )))
 842                                 return False;
 843                 }
 844                 if ( !prs_uint8s( True, "name", ps, depth, (uint8*)vk->valuename, name_length ) )
 845                         return False;
 846         }
 847
 848         end_off = prs_offset( &hbin->ps );
 849
 850         /* get the data if necessary */
 851
 852         if ( vk->data_size != 0 ) {
 853                 bool charmode = False;
 854
 855                 if ( (vk->type == REG_SZ) || (vk->type == REG_MULTI_SZ) )
 856                         charmode = True;
 857
 858                 /* the data is stored in the offset if the size <= 4 */
 859
 860                 if ( !(vk->data_size & VK_DATA_IN_OFFSET) ) {
 861                         REGF_HBIN *hblock = hbin;
 862                         uint32 data_rec_size;
 863
 864                         if ( UNMARSHALLING(&hbin->ps) ) {
 865                                 if ( !(vk->data = PRS_ALLOC_MEM( ps, uint8, vk->data_size) ) )
 866                                         return False;
 867                         }
 868
 869                         /* this data can be in another hbin */
 870                         if ( !hbin_contains_offset( hbin, vk->data_off ) ) {
 871                                 if ( !(hblock = lookup_hbin_block( file, vk->data_off )) )
 872                                         return False;
 873                         }
 874                         if ( !(prs_set_offset( &hblock->ps, (vk->data_off+HBIN_HDR_SIZE-hblock->first_hbin_off)-sizeof(uint32) )) )
 875                                 return False;
 876
 877                         if ( MARSHALLING(&hblock->ps) ) {
 878                                 data_rec_size = ( (vk->data_size+sizeof(uint32)) & 0xfffffff8 ) + 8;
 879                                 data_rec_size = ( data_rec_size - 1 ) ^ 0xFFFFFFFF;
 880                         }
 881                         if ( !prs_uint32( "data_rec_size", &hblock->ps, depth, &data_rec_size ))
 882                                 return False;
 883                         if ( !prs_uint8s( charmode, "data", &hblock->ps, depth, vk->data, vk->data_size) )
 884                                 return False;
 885
 886                         if ( MARSHALLING(&hblock->ps) )
 887                                 hblock->dirty = True;
 888                 }
 889                 else {
 890                         if ( !(vk->data = PRS_ALLOC_MEM( ps, uint8, 4 ) ) )
 891                                 return False;
 892                         SIVAL( vk->data, 0, vk->data_off );
 893                 }
 894
 895         }
 896
 897         /* data_size must be divisible by 8 and large enough to hold the original record */
 898
 899         data_size = ((start_off - end_off ) & 0xfffffff8 );
 900         if ( data_size !=  vk->rec_size )
 901                 DEBUG(10,("prs_vk_rec: data_size check failed (0x%x < 0x%x)\n", data_size, vk->rec_size));
 902
 903         if ( MARSHALLING(&hbin->ps) )
 904                 hbin->dirty = True;
 905
 906         return True;
 907 }
 908
 909 /*******************************************************************
 910  read a VK record which is contained in the HBIN block stored
 911  in the prs_struct *ps.
 912 *******************************************************************/
 913
 914 static bool hbin_prs_vk_records( const char *desc, REGF_HBIN *hbin, int depth, REGF_NK_REC *nk, REGF_FILE *file )
 915 {
 916         int i;
 917         uint32 record_size;
 918
 919         prs_debug(&hbin->ps, depth, desc, "prs_vk_records");
 920         depth++;
 921
 922         /* check if we have anything to do first */
 923
 924         if ( nk->num_values == 0 )
 925                 return True;
 926
 927         if ( UNMARSHALLING(&hbin->ps) ) {
 928                 if ( !(nk->values = PRS_ALLOC_MEM( &hbin->ps, REGF_VK_REC, nk->num_values ) ) )
 929                         return False;
 930         }
 931
 932         /* convert the offset to something relative to this HBIN block */
 933
 934         if ( !prs_set_offset( &hbin->ps, nk->values_off+HBIN_HDR_SIZE-hbin->first_hbin_off-sizeof(uint32)) )
 935                 return False;
 936
 937         if ( MARSHALLING( &hbin->ps) ) {
 938                 record_size = ( ( nk->num_values * sizeof(uint32) ) & 0xfffffff8 ) + 8;
 939                 record_size = (record_size - 1) ^ 0xFFFFFFFF;
 940         }
 941
 942         if ( !prs_uint32( "record_size", &hbin->ps, depth, &record_size ) )
 943                 return False;
 944
 945         for ( i=0; i<nk->num_values; i++ ) {
 946                 if ( !prs_uint32( "vk_off", &hbin->ps, depth, &nk->values[i].rec_off ) )
 947                         return False;
 948         }
 949
 950         for ( i=0; i<nk->num_values; i++ ) {
 951                 REGF_HBIN *sub_hbin = hbin;
 952                 uint32 new_offset;
 953
 954                 if ( !hbin_contains_offset( hbin, nk->values[i].rec_off ) ) {
 955                         sub_hbin = lookup_hbin_block( file, nk->values[i].rec_off );
 956                         if ( !sub_hbin ) {
 957                                 DEBUG(0,("hbin_prs_vk_records: Failed to find HBIN block containing offset [0x%x]\n",
 958                                         nk->values[i].hbin_off));
 959                                 return False;
 960                         }
 961                 }
 962
 963                 new_offset = nk->values[i].rec_off + HBIN_HDR_SIZE - sub_hbin->first_hbin_off;
 964                 if ( !prs_set_offset( &sub_hbin->ps, new_offset ) )
 965                         return False;
 966                 if ( !hbin_prs_vk_rec( "vk_rec", sub_hbin, depth, &nk->values[i], file ) )
 967                         return False;
 968         }
 969
 970         if ( MARSHALLING(&hbin->ps) )
 971                 hbin->dirty = True;
 972
 973
 974         return True;
 975 }
 976
 977
 978 /*******************************************************************
 979 *******************************************************************/
 980
 981 static REGF_SK_REC* find_sk_record_by_offset( REGF_FILE *file, uint32 offset )
 982 {
 983         REGF_SK_REC *p_sk;
 984
 985         for ( p_sk=file->sec_desc_list; p_sk; p_sk=p_sk->next ) {
 986                 if ( p_sk->sk_off == offset )
 987                         return p_sk;
 988         }
 989
 990         return NULL;
 991 }
 992
 993 /*******************************************************************
 994 *******************************************************************/
 995
 996 static REGF_SK_REC* find_sk_record_by_sec_desc( REGF_FILE *file, struct security_descriptor *sd )
 997 {
 998         REGF_SK_REC *p;
 999
1000         for ( p=file->sec_desc_list; p; p=p->next ) {
1001                 if ( security_descriptor_equal( p->sec_desc, sd ) )
1002                         return p;
1003         }
1004
1005         /* failure */
1006
1007         return NULL;
1008 }
1009
1010 /*******************************************************************
1011 *******************************************************************/
1012
1013 static bool hbin_prs_key( REGF_FILE *file, REGF_HBIN *hbin, REGF_NK_REC *nk )
1014 {
1015         int depth = 0;
1016         REGF_HBIN *sub_hbin;
1017
1018         prs_debug(&hbin->ps, depth, "", "fetch_key");
1019         depth++;
1020
1021         /* get the initial nk record */
1022
1023         if ( !prs_nk_rec( "nk_rec", &hbin->ps, depth, nk ))
1024                 return False;
1025
1026         /* fill in values */
1027
1028         if ( nk->num_values && (nk->values_off!=REGF_OFFSET_NONE) ) {
1029                 sub_hbin = hbin;
1030                 if ( !hbin_contains_offset( hbin, nk->values_off ) ) {
1031                         sub_hbin = lookup_hbin_block( file, nk->values_off );
1032                         if ( !sub_hbin ) {
1033                                 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing value_list_offset [0x%x]\n",
1034                                         nk->values_off));
1035                                 return False;
1036                         }
1037                 }
1038
1039                 if ( !hbin_prs_vk_records( "vk_rec", sub_hbin, depth, nk, file ))
1040                         return False;
1041         }
1042
1043         /* now get subkeys */
1044
1045         if ( nk->num_subkeys && (nk->subkeys_off!=REGF_OFFSET_NONE) ) {
1046                 sub_hbin = hbin;
1047                 if ( !hbin_contains_offset( hbin, nk->subkeys_off ) ) {
1048                         sub_hbin = lookup_hbin_block( file, nk->subkeys_off );
1049                         if ( !sub_hbin ) {
1050                                 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing subkey_offset [0x%x]\n",
1051                                         nk->subkeys_off));
1052                                 return False;
1053                         }
1054                 }
1055
1056                 if ( !hbin_prs_lf_records( "lf_rec", sub_hbin, depth, nk ))
1057                         return False;
1058         }
1059
1060         /* get the to the security descriptor.  First look if we have already parsed it */
1061
1062         if ( (nk->sk_off!=REGF_OFFSET_NONE) && !( nk->sec_desc = find_sk_record_by_offset( file, nk->sk_off )) ) {
1063
1064                 sub_hbin = hbin;
1065                 if ( !hbin_contains_offset( hbin, nk->sk_off ) ) {
1066                         sub_hbin = lookup_hbin_block( file, nk->sk_off );
1067                         if ( !sub_hbin ) {
1068                                 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing sk_offset [0x%x]\n",
1069                                         nk->subkeys_off));
1070                                 return False;
1071                         }
1072                 }
1073
1074                 if ( !(nk->sec_desc = TALLOC_ZERO_P( file->mem_ctx, REGF_SK_REC )) )
1075                         return False;
1076                 nk->sec_desc->sk_off = nk->sk_off;
1077                 if ( !hbin_prs_sk_rec( "sk_rec", sub_hbin, depth, nk->sec_desc ))
1078                         return False;
1079
1080                 /* add to the list of security descriptors (ref_count has been read from the files) */
1081
1082                 nk->sec_desc->sk_off = nk->sk_off;
1083                 DLIST_ADD( file->sec_desc_list, nk->sec_desc );
1084         }
1085
1086         return True;
1087 }
1088
1089 /*******************************************************************
1090 *******************************************************************/
1091
1092 static bool next_record( REGF_HBIN *hbin, const char *hdr, bool *eob )
1093 {
1094         uint8 header[REC_HDR_SIZE];
1095         uint32 record_size;
1096         uint32 curr_off, block_size;
1097         bool found = False;
1098         prs_struct *ps = &hbin->ps;
1099
1100         curr_off = prs_offset( ps );
1101         if ( curr_off == 0 )
1102                 prs_set_offset( ps, HBIN_HEADER_REC_SIZE );
1103
1104         /* assume that the current offset is at the record header
1105            and we need to backup to read the record size */
1106
1107         curr_off -= sizeof(uint32);
1108
1109         block_size = prs_data_size( ps );
1110         record_size = 0;
1111         memset( header, 0x0, sizeof(uint8)*REC_HDR_SIZE );
1112         while ( !found ) {
1113
1114                 curr_off = curr_off+record_size;
1115                 if ( curr_off >= block_size )
1116                         break;
1117
1118                 if ( !prs_set_offset( &hbin->ps, curr_off) )
1119                         return False;
1120
1121                 if ( !prs_uint32( "record_size", ps, 0, &record_size ) )
1122                         return False;
1123                 if ( !prs_uint8s( True, "header", ps, 0, header, REC_HDR_SIZE ) )
1124                         return False;
1125
1126                 if ( record_size & 0x80000000 ) {
1127                         /* absolute_value(record_size) */
1128                         record_size = (record_size ^ 0xffffffff) + 1;
1129                 }
1130
1131                 if ( memcmp( header, hdr, REC_HDR_SIZE ) == 0 ) {
1132                         found = True;
1133                         curr_off += sizeof(uint32);
1134                 }
1135         }
1136
1137         /* mark prs_struct as done ( at end ) if no more SK records */
1138         /* mark end-of-block as True */
1139
1140         if ( !found ) {
1141                 prs_set_offset( &hbin->ps, prs_data_size(&hbin->ps) );
1142                 *eob = True;
1143                 return False;
1144         }
1145
1146         if ( !prs_set_offset( ps, curr_off ) )
1147                 return False;
1148
1149         return True;
1150 }
1151
1152 /*******************************************************************
1153 *******************************************************************/
1154
1155 static bool next_nk_record( REGF_FILE *file, REGF_HBIN *hbin, REGF_NK_REC *nk, bool *eob )
1156 {
1157         if ( next_record( hbin, "nk", eob ) && hbin_prs_key( file, hbin, nk ) )
1158                 return True;
1159
1160         return False;
1161 }
1162
1163 /*******************************************************************
1164  Intialize the newly created REGF_BLOCK in *file and write the
1165  block header to disk
1166 *******************************************************************/
1167
1168 static bool init_regf_block( REGF_FILE *file )
1169 {
1170         prs_struct ps;
1171         bool result = True;
1172
1173         if ( !prs_init( &ps, REGF_BLOCKSIZE, file->mem_ctx, MARSHALL ) )
1174                 return False;
1175
1176         memcpy( file->header, "regf", REGF_HDR_SIZE );
1177         file->data_offset = 0x20;
1178         file->last_block  = 0x1000;
1179
1180         /* set mod time */
1181
1182         unix_to_nt_time( &file->mtime, time(NULL) );
1183
1184         /* hard coded values...no diea what these are ... maybe in time */
1185
1186         file->unknown1 = 0x2;
1187         file->unknown2 = 0x1;
1188         file->unknown3 = 0x3;
1189         file->unknown4 = 0x0;
1190         file->unknown5 = 0x1;
1191         file->unknown6 = 0x1;
1192
1193         /* write header to the buffer */
1194
1195         if ( !prs_regf_block( "regf_header", &ps, 0, file ) ) {
1196                 result = False;
1197                 goto out;
1198         }
1199
1200         /* calculate the checksum, re-marshall data (to include the checksum)
1201            and write to disk */
1202
1203         file->checksum = regf_block_checksum( &ps );
1204         prs_set_offset( &ps, 0 );
1205         if ( !prs_regf_block( "regf_header", &ps, 0, file ) ) {
1206                 result = False;
1207                 goto out;
1208         }
1209
1210         if ( write_block( file, &ps, 0 ) == -1 ) {
1211                 DEBUG(0,("init_regf_block: Failed to initialize registry header block!\n"));
1212                 result = False;
1213                 goto out;
1214         }
1215
1216 out:
1217         prs_mem_free( &ps );
1218
1219         return result;
1220 }
1221 /*******************************************************************
1222  Open the registry file and then read in the REGF block to get the
1223  first hbin offset.
1224 *******************************************************************/
1225
1226  REGF_FILE* regfio_open( const char *filename, int flags, int mode )
1227 {
1228         REGF_FILE *rb;
1229
1230         if ( !(rb = SMB_MALLOC_P(REGF_FILE)) ) {
1231                 DEBUG(0,("ERROR allocating memory\n"));
1232                 return NULL;
1233         }
1234         ZERO_STRUCTP( rb );
1235         rb->fd = -1;
1236
1237         if ( !(rb->mem_ctx = talloc_init( "read_regf_block" )) ) {
1238                 regfio_close( rb );
1239                 return NULL;
1240         }
1241
1242         rb->open_flags = flags;
1243
1244         /* open and existing file */
1245
1246         if ( (rb->fd = open(filename, flags, mode)) == -1 ) {
1247                 DEBUG(0,("regfio_open: failure to open %s (%s)\n", filename, strerror(errno)));
1248                 regfio_close( rb );
1249                 return NULL;
1250         }
1251
1252         /* check if we are creating a new file or overwriting an existing one */
1253
1254         if ( flags & (O_CREAT|O_TRUNC) ) {
1255                 if ( !init_regf_block( rb ) ) {
1256                         DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));
1257                         regfio_close( rb );
1258                         return NULL;
1259                 }
1260
1261                 /* success */
1262                 return rb;
1263         }
1264
1265         /* read in an existing file */
1266
1267         if ( !read_regf_block( rb ) ) {
1268                 DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));
1269                 regfio_close( rb );
1270                 return NULL;
1271         }
1272
1273         /* success */
1274
1275         return rb;
1276 }
1277
1278 /*******************************************************************
1279 *******************************************************************/
1280
1281 static void regfio_mem_free( REGF_FILE *file )
1282 {
1283         /* free any talloc()'d memory */
1284
1285         if ( file && file->mem_ctx )
1286                 talloc_destroy( file->mem_ctx );
1287 }
1288
1289 /*******************************************************************
1290 *******************************************************************/
1291
1292  int regfio_close( REGF_FILE *file )
1293 {
1294         int fd;
1295
1296         /* cleanup for a file opened for write */
1297
1298         if ((file->fd != -1) && (file->open_flags & (O_WRONLY|O_RDWR))) {
1299                 prs_struct ps;
1300                 REGF_SK_REC *sk;
1301
1302                 /* write of sd list */
1303
1304                 for ( sk=file->sec_desc_list; sk; sk=sk->next ) {
1305                         hbin_prs_sk_rec( "sk_rec", sk->hbin, 0, sk );
1306                 }
1307
1308                 /* flush any dirty blocks */
1309
1310                 while ( file->block_list ) {
1311                         hbin_block_close( file, file->block_list );
1312                 }
1313
1314                 ZERO_STRUCT( ps );
1315
1316                 unix_to_nt_time( &file->mtime, time(NULL) );
1317
1318                 if ( read_block( file, &ps, 0, REGF_BLOCKSIZE ) != -1 ) {
1319                         /* now use for writing */
1320                         prs_switch_type( &ps, MARSHALL );
1321
1322                         /* stream the block once, generate the checksum,
1323                            and stream it again */
1324                         prs_set_offset( &ps, 0 );
1325                         prs_regf_block( "regf_blocK", &ps, 0, file );
1326                         file->checksum = regf_block_checksum( &ps );
1327                         prs_set_offset( &ps, 0 );
1328                         prs_regf_block( "regf_blocK", &ps, 0, file );
1329
1330                         /* now we are ready to write it to disk */
1331                         if ( write_block( file, &ps, 0 ) == -1 )
1332                                 DEBUG(0,("regfio_close: failed to update the regf header block!\n"));
1333                 }
1334
1335                 prs_mem_free( &ps );
1336         }
1337
1338         regfio_mem_free( file );
1339
1340         /* nothing tdo do if there is no open file */
1341
1342         if (file->fd == -1)
1343                 return 0;
1344
1345         fd = file->fd;
1346         file->fd = -1;
1347         SAFE_FREE( file );
1348
1349         return close( fd );
1350 }
1351
1352 /*******************************************************************
1353 *******************************************************************/
1354
1355 static void regfio_flush( REGF_FILE *file )
1356 {
1357         REGF_HBIN *hbin;
1358
1359         for ( hbin=file->block_list; hbin; hbin=hbin->next ) {
1360                 write_hbin_block( file, hbin );
1361         }
1362 }
1363
1364 /*******************************************************************
1365  There should be only *one* root key in the registry file based
1366  on my experience.  --jerry
1367 *******************************************************************/
1368
1369 REGF_NK_REC* regfio_rootkey( REGF_FILE *file )
1370 {
1371         REGF_NK_REC *nk;
1372         REGF_HBIN   *hbin;
1373         uint32      offset = REGF_BLOCKSIZE;
1374         bool        found = False;
1375         bool        eob;
1376
1377         if ( !file )
1378                 return NULL;
1379
1380         if ( !(nk = TALLOC_ZERO_P( file->mem_ctx, REGF_NK_REC )) ) {
1381                 DEBUG(0,("regfio_rootkey: talloc() failed!\n"));
1382                 return NULL;
1383         }
1384
1385         /* scan through the file on HBIN block at a time looking
1386            for an NK record with a type == 0x002c.
1387            Normally this is the first nk record in the first hbin
1388            block (but I'm not assuming that for now) */
1389
1390         while ( (hbin = read_hbin_block( file, offset )) ) {
1391                 eob = False;
1392
1393                 while ( !eob) {
1394                         if ( next_nk_record( file, hbin, nk, &eob ) ) {
1395                                 if ( nk->key_type == NK_TYPE_ROOTKEY ) {
1396                                         found = True;
1397                                         break;
1398                                 }
1399                         }
1400                         prs_mem_free( &hbin->ps );
1401                 }
1402
1403                 if ( found )
1404                         break;
1405
1406                 offset += hbin->block_size;
1407         }
1408
1409         if ( !found ) {
1410                 DEBUG(0,("regfio_rootkey: corrupt registry file ?  No root key record located\n"));
1411                 return NULL;
1412         }
1413
1414         DLIST_ADD( file->block_list, hbin );
1415
1416         return nk;
1417 }
1418
1419 /*******************************************************************
1420  This acts as an interator over the subkeys defined for a given
1421  NK record.  Remember that offsets are from the *first* HBIN block.
1422 *******************************************************************/
1423
1424  REGF_NK_REC* regfio_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk )
1425 {
1426         REGF_NK_REC *subkey;
1427         REGF_HBIN   *hbin;
1428         uint32      nk_offset;
1429
1430         /* see if there is anything left to report */
1431
1432         if ( !nk || (nk->subkeys_off==REGF_OFFSET_NONE) || (nk->subkey_index >= nk->num_subkeys) )
1433                 return NULL;
1434
1435         /* find the HBIN block which should contain the nk record */
1436
1437         if ( !(hbin = lookup_hbin_block( file, nk->subkeys.hashes[nk->subkey_index].nk_off )) ) {
1438                 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing offset [0x%x]\n",
1439                         nk->subkeys.hashes[nk->subkey_index].nk_off));
1440                 return NULL;
1441         }
1442
1443         nk_offset = nk->subkeys.hashes[nk->subkey_index].nk_off;
1444         if ( !prs_set_offset( &hbin->ps, (HBIN_HDR_SIZE + nk_offset - hbin->first_hbin_off) ) )
1445                 return NULL;
1446
1447         nk->subkey_index++;
1448         if ( !(subkey = TALLOC_ZERO_P( file->mem_ctx, REGF_NK_REC )) )
1449                 return NULL;
1450
1451         if ( !hbin_prs_key( file, hbin, subkey ) )
1452                 return NULL;
1453
1454         return subkey;
1455 }
1456
1457
1458 /*******************************************************************
1459 *******************************************************************/
1460
1461 static REGF_HBIN* regf_hbin_allocate( REGF_FILE *file, uint32 block_size )
1462 {
1463         REGF_HBIN *hbin;
1464         SMB_STRUCT_STAT sbuf;
1465
1466         if ( !(hbin = TALLOC_ZERO_P( file->mem_ctx, REGF_HBIN )) )
1467                 return NULL;
1468
1469         memcpy( hbin->header, "hbin", sizeof(HBIN_HDR_SIZE) );
1470
1471
1472         if (sys_fstat(file->fd, &sbuf, false)) {
1473                 DEBUG(0,("regf_hbin_allocate: stat() failed! (%s)\n", strerror(errno)));
1474                 return NULL;
1475         }
1476
1477         hbin->file_off       = sbuf.st_ex_size;
1478
1479         hbin->free_off       = HBIN_HEADER_REC_SIZE;
1480         hbin->free_size      = block_size - hbin->free_off + sizeof(uint32);
1481
1482         hbin->block_size     = block_size;
1483         hbin->first_hbin_off = hbin->file_off - REGF_BLOCKSIZE;
1484
1485         if ( !prs_init( &hbin->ps, block_size, file->mem_ctx, MARSHALL ) )
1486                 return NULL;
1487
1488         if ( !prs_hbin_block( "new_hbin", &hbin->ps, 0, hbin ) )
1489                 return NULL;
1490
1491         if ( !write_hbin_block( file, hbin ) )
1492                 return NULL;
1493
1494         file->last_block = hbin->file_off;
1495
1496         return hbin;
1497 }
1498
1499 /*******************************************************************
1500 *******************************************************************/
1501
1502 static void update_free_space( REGF_HBIN *hbin, uint32 size_used )
1503 {
1504         hbin->free_off  += size_used;
1505         hbin->free_size -= size_used;
1506
1507         if ( hbin->free_off >= hbin->block_size ) {
1508                 hbin->free_off = REGF_OFFSET_NONE;
1509         }
1510
1511         return;
1512 }
1513
1514 /*******************************************************************
1515 *******************************************************************/
1516
1517 static REGF_HBIN* find_free_space( REGF_FILE *file, uint32 size )
1518 {
1519         REGF_HBIN *hbin, *p_hbin;
1520         uint32 block_off;
1521         bool cached;
1522
1523         /* check open block list */
1524
1525         for ( hbin=file->block_list; hbin!=NULL; hbin=hbin->next ) {
1526                 /* only check blocks that actually have available space */
1527
1528                 if ( hbin->free_off == REGF_OFFSET_NONE )
1529                         continue;
1530
1531                 /* check for a large enough available chunk */
1532
1533                 if ( (hbin->block_size - hbin->free_off) >= size ) {
1534                         DLIST_PROMOTE( file->block_list, hbin );
1535                         goto done;
1536                 }
1537         }
1538
1539         /* parse the file until we find a block with
1540            enough free space; save the last non-filled hbin */
1541
1542         block_off = REGF_BLOCKSIZE;
1543         do {
1544                 /* cleanup before the next round */
1545                 cached = False;
1546                 if ( hbin )
1547                         prs_mem_free( &hbin->ps );
1548
1549                 hbin = read_hbin_block( file, block_off );
1550
1551                 if ( hbin ) {
1552
1553                         /* make sure that we don't already have this block in memory */
1554
1555                         for ( p_hbin=file->block_list; p_hbin!=NULL; p_hbin=p_hbin->next ) {
1556                                 if ( p_hbin->file_off == hbin->file_off ) {
1557                                         cached = True;
1558                                         break;
1559                                 }
1560                         }
1561
1562                         block_off = hbin->file_off + hbin->block_size;
1563
1564                         if ( cached ) {
1565                                 prs_mem_free( &hbin->ps );
1566                                 hbin = NULL;
1567                                 continue;
1568                         }
1569                 }
1570         /* if (cached block or (new block and not enough free space)) then continue looping */
1571         } while ( cached || (hbin && (hbin->free_size < size)) );
1572
1573         /* no free space; allocate a new one */
1574
1575         if ( !hbin ) {
1576                 uint32 alloc_size;
1577
1578                 /* allocate in multiples of REGF_ALLOC_BLOCK; make sure (size + hbin_header) fits */
1579
1580                 alloc_size = (((size+HBIN_HEADER_REC_SIZE) / REGF_ALLOC_BLOCK ) + 1 ) * REGF_ALLOC_BLOCK;
1581
1582                 if ( !(hbin = regf_hbin_allocate( file, alloc_size )) ) {
1583                         DEBUG(0,("find_free_space: regf_hbin_allocate() failed!\n"));
1584                         return NULL;
1585                 }
1586                 DLIST_ADD( file->block_list, hbin );
1587         }
1588
1589 done:
1590         /* set the offset to be ready to write */
1591
1592         if ( !prs_set_offset( &hbin->ps, hbin->free_off-sizeof(uint32) ) )
1593                 return NULL;
1594
1595         /* write the record size as a placeholder for now, it should be
1596            probably updated by the caller once it all of the data necessary
1597            for the record */
1598
1599         if ( !prs_uint32("allocated_size", &hbin->ps, 0, &size) )
1600                 return False;
1601
1602         update_free_space( hbin, size );
1603
1604         return hbin;
1605 }
1606
1607 /*******************************************************************
1608 *******************************************************************/
1609
1610 static uint32 sk_record_data_size( struct security_descriptor * sd )
1611 {
1612         uint32 size, size_mod8;
1613
1614         size_mod8 = 0;
1615
1616         /* the record size is sizeof(hdr) + name + static members + data_size_field */
1617
1618         size = sizeof(uint32)*5 + ndr_size_security_descriptor(sd, 0) + sizeof(uint32);
1619
1620         /* multiple of 8 */
1621         size_mod8 = size & 0xfffffff8;
1622         if ( size_mod8 < size )
1623                 size_mod8 += 8;
1624
1625         return size_mod8;
1626 }
1627
1628 /*******************************************************************
1629 *******************************************************************/
1630
1631 static uint32 vk_record_data_size( REGF_VK_REC *vk )
1632 {
1633         uint32 size, size_mod8;
1634
1635         size_mod8 = 0;
1636
1637         /* the record size is sizeof(hdr) + name + static members + data_size_field */
1638
1639         size = REC_HDR_SIZE + (sizeof(uint16)*3) + (sizeof(uint32)*3) + sizeof(uint32);
1640
1641         if ( vk->valuename )
1642                 size += strlen(vk->valuename);
1643
1644         /* multiple of 8 */
1645         size_mod8 = size & 0xfffffff8;
1646         if ( size_mod8 < size )
1647                 size_mod8 += 8;
1648
1649         return size_mod8;
1650 }
1651
1652 /*******************************************************************
1653 *******************************************************************/
1654
1655 static uint32 lf_record_data_size( uint32 num_keys )
1656 {
1657         uint32 size, size_mod8;
1658
1659         size_mod8 = 0;
1660
1661         /* the record size is sizeof(hdr) + num_keys + sizeof of hash_array + data_size_uint32 */
1662
1663         size = REC_HDR_SIZE + sizeof(uint16) + (sizeof(REGF_HASH_REC) * num_keys) + sizeof(uint32);
1664
1665         /* multiple of 8 */
1666         size_mod8 = size & 0xfffffff8;
1667         if ( size_mod8 < size )
1668                 size_mod8 += 8;
1669
1670         return size_mod8;
1671 }
1672
1673 /*******************************************************************
1674 *******************************************************************/
1675
1676 static uint32 nk_record_data_size( REGF_NK_REC *nk )
1677 {
1678         uint32 size, size_mod8;
1679
1680         size_mod8 = 0;
1681
1682         /* the record size is static + length_of_keyname + length_of_classname + data_size_uint32 */
1683
1684         size = 0x4c + strlen(nk->keyname) + sizeof(uint32);
1685
1686         if ( nk->classname )
1687                 size += strlen( nk->classname );
1688
1689         /* multiple of 8 */
1690         size_mod8 = size & 0xfffffff8;
1691         if ( size_mod8 < size )
1692                 size_mod8 += 8;
1693
1694         return size_mod8;
1695 }
1696
1697 /*******************************************************************
1698 *******************************************************************/
1699
1700 static bool create_vk_record(REGF_FILE *file, REGF_VK_REC *vk,
1701                              struct regval_blob *value)
1702 {
1703         char *name = regval_name(value);
1704         REGF_HBIN *data_hbin;
1705
1706         ZERO_STRUCTP( vk );
1707
1708         memcpy( vk->header, "vk", REC_HDR_SIZE );
1709
1710         if ( name ) {
1711                 vk->valuename = talloc_strdup( file->mem_ctx, regval_name(value) );
1712                 vk->flag = VK_FLAG_NAME_PRESENT;
1713         }
1714
1715         vk->data_size = regval_size( value );
1716         vk->type      = regval_type( value );
1717
1718         if ( vk->data_size > sizeof(uint32) ) {
1719                 uint32 data_size = ( (vk->data_size+sizeof(uint32)) & 0xfffffff8 ) + 8;
1720
1721                 vk->data = (uint8 *)TALLOC_MEMDUP( file->mem_ctx,
1722                                                    regval_data_p(value),
1723                                                    vk->data_size );
1724                 if (vk->data == NULL) {
1725                         return False;
1726                 }
1727
1728                 /* go ahead and store the offset....we'll pick this hbin block back up when
1729                    we stream the data */
1730
1731                 if ((data_hbin = find_free_space(file, data_size )) == NULL) {
1732                         return False;
1733                 }
1734                 vk->data_off = prs_offset( &data_hbin->ps ) + data_hbin->first_hbin_off - HBIN_HDR_SIZE;
1735         }
1736         else {
1737                 /* make sure we don't try to copy from a NULL value pointer */
1738
1739                 if ( vk->data_size != 0 )
1740                         memcpy( &vk->data_off, regval_data_p(value), sizeof(uint32) );
1741                 vk->data_size |= VK_DATA_IN_OFFSET;
1742         }
1743
1744         return True;
1745 }
1746
1747 /*******************************************************************
1748 *******************************************************************/
1749
1750 static int hashrec_cmp( REGF_HASH_REC *h1, REGF_HASH_REC *h2 )
1751 {
1752         return StrCaseCmp( h1->fullname, h2->fullname );
1753 }
1754
1755 /*******************************************************************
1756 *******************************************************************/
1757
1758  REGF_NK_REC* regfio_write_key( REGF_FILE *file, const char *name,
1759                                struct regval_ctr *values, struct regsubkey_ctr *subkeys,
1760                                struct security_descriptor *sec_desc, REGF_NK_REC *parent )
1761 {
1762         REGF_NK_REC *nk;
1763         REGF_HBIN *vlist_hbin = NULL;
1764         uint32 size;
1765
1766         if ( !(nk = TALLOC_ZERO_P( file->mem_ctx, REGF_NK_REC )) )
1767                 return NULL;
1768
1769         memcpy( nk->header, "nk", REC_HDR_SIZE );
1770
1771         if ( !parent )
1772                 nk->key_type = NK_TYPE_ROOTKEY;
1773         else
1774                 nk->key_type = NK_TYPE_NORMALKEY;
1775
1776         /* store the parent offset (or -1 if a the root key */
1777
1778         nk->parent_off = parent ? (parent->hbin_off + parent->hbin->file_off - REGF_BLOCKSIZE - HBIN_HDR_SIZE ) : REGF_OFFSET_NONE;
1779
1780         /* no classname currently */
1781
1782         nk->classname_off = REGF_OFFSET_NONE;
1783         nk->classname = NULL;
1784         nk->keyname = talloc_strdup( file->mem_ctx, name );
1785
1786         /* current modification time */
1787
1788         unix_to_nt_time( &nk->mtime, time(NULL) );
1789
1790         /* allocate the record on disk */
1791
1792         size = nk_record_data_size( nk );
1793         nk->rec_size = ( size - 1 ) ^ 0XFFFFFFFF;
1794         if ((nk->hbin = find_free_space( file, size )) == NULL) {
1795                 return NULL;
1796         }
1797         nk->hbin_off = prs_offset( &nk->hbin->ps );
1798
1799         /* Update the hash record in the parent */
1800
1801         if ( parent ) {
1802                 REGF_HASH_REC *hash = &parent->subkeys.hashes[parent->subkey_index];
1803
1804                 hash->nk_off = prs_offset( &nk->hbin->ps ) + nk->hbin->first_hbin_off - HBIN_HDR_SIZE;
1805                 memcpy( hash->keycheck, name, sizeof(uint32) );
1806                 hash->fullname = talloc_strdup( file->mem_ctx, name );
1807                 parent->subkey_index++;
1808
1809                 /* sort the list by keyname */
1810                 TYPESAFE_QSORT(parent->subkeys.hashes, parent->subkey_index, hashrec_cmp);
1811
1812                 if ( !hbin_prs_lf_records( "lf_rec", parent->subkeys.hbin, 0, parent ) )
1813                         return False;
1814         }
1815
1816         /* write the security descriptor */
1817
1818         nk->sk_off = REGF_OFFSET_NONE;
1819         if ( sec_desc ) {
1820                 uint32 sk_size = sk_record_data_size( sec_desc );
1821                 REGF_HBIN *sk_hbin;
1822
1823                 /* search for it in the existing list of sd's */
1824
1825                 if ( (nk->sec_desc = find_sk_record_by_sec_desc( file, sec_desc )) == NULL ) {
1826                         /* not found so add it to the list */
1827
1828                         if (!(sk_hbin = find_free_space( file, sk_size ))) {
1829                                 return NULL;
1830                         }
1831
1832                         if ( !(nk->sec_desc = TALLOC_ZERO_P( file->mem_ctx, REGF_SK_REC )) )
1833                                 return NULL;
1834
1835                         /* now we have to store the security descriptor in the list and
1836                            update the offsets */
1837
1838                         memcpy( nk->sec_desc->header, "sk", REC_HDR_SIZE );
1839                         nk->sec_desc->hbin      = sk_hbin;
1840                         nk->sec_desc->hbin_off  = prs_offset( &sk_hbin->ps );
1841                         nk->sec_desc->sk_off    = prs_offset( &sk_hbin->ps ) + sk_hbin->first_hbin_off - HBIN_HDR_SIZE;
1842                         nk->sec_desc->rec_size  = (sk_size-1)  ^ 0xFFFFFFFF;
1843
1844                         nk->sec_desc->sec_desc  = sec_desc;
1845                         nk->sec_desc->ref_count = 0;
1846
1847                         /* size value must be self-inclusive */
1848                         nk->sec_desc->size      = ndr_size_security_descriptor(sec_desc, 0)
1849                                 + sizeof(uint32);
1850
1851                         DLIST_ADD_END( file->sec_desc_list, nk->sec_desc, REGF_SK_REC *);
1852
1853                         /* update the offsets for us and the previous sd in the list.
1854                            if this is the first record, then just set the next and prev
1855                            offsets to ourself. */
1856
1857                         if ( DLIST_PREV(nk->sec_desc) ) {
1858                                 REGF_SK_REC *prev = DLIST_PREV(nk->sec_desc);
1859
1860                                 nk->sec_desc->prev_sk_off = prev->hbin_off + prev->hbin->first_hbin_off - HBIN_HDR_SIZE;
1861                                 prev->next_sk_off = nk->sec_desc->sk_off;
1862
1863                                 /* the end must loop around to the front */
1864                                 nk->sec_desc->next_sk_off = file->sec_desc_list->sk_off;
1865
1866                                 /* and first must loop around to the tail */
1867                                 file->sec_desc_list->prev_sk_off = nk->sec_desc->sk_off;
1868                         } else {
1869                                 nk->sec_desc->prev_sk_off = nk->sec_desc->sk_off;
1870                                 nk->sec_desc->next_sk_off = nk->sec_desc->sk_off;
1871                         }
1872                 }
1873
1874                 /* bump the reference count +1 */
1875
1876                 nk->sk_off = nk->sec_desc->sk_off;
1877                 nk->sec_desc->ref_count++;
1878         }
1879
1880         /* write the subkeys */
1881
1882         nk->subkeys_off = REGF_OFFSET_NONE;
1883         if ( (nk->num_subkeys = regsubkey_ctr_numkeys( subkeys )) != 0 ) {
1884                 uint32 lf_size = lf_record_data_size( nk->num_subkeys );
1885                 uint32 namelen;
1886                 int i;
1887
1888                 if (!(nk->subkeys.hbin = find_free_space( file, lf_size ))) {
1889                         return NULL;
1890                 }
1891                 nk->subkeys.hbin_off = prs_offset( &nk->subkeys.hbin->ps );
1892                 nk->subkeys.rec_size = (lf_size-1) ^ 0xFFFFFFFF;
1893                 nk->subkeys_off = prs_offset( &nk->subkeys.hbin->ps ) + nk->subkeys.hbin->first_hbin_off - HBIN_HDR_SIZE;
1894
1895                 memcpy( nk->subkeys.header, "lf", REC_HDR_SIZE );
1896
1897                 nk->subkeys.num_keys = nk->num_subkeys;
1898                 if (nk->subkeys.num_keys) {
1899                         if ( !(nk->subkeys.hashes = TALLOC_ZERO_ARRAY( file->mem_ctx, REGF_HASH_REC, nk->subkeys.num_keys )) )
1900                                 return NULL;
1901                 } else {
1902                         nk->subkeys.hashes = NULL;
1903                 }
1904                 nk->subkey_index = 0;
1905
1906                 /* update the max_bytes_subkey{name,classname} fields */
1907                 for ( i=0; i<nk->num_subkeys; i++ ) {
1908                         namelen = strlen( regsubkey_ctr_specific_key(subkeys, i) );
1909                         if ( namelen*2 > nk->max_bytes_subkeyname )
1910                                 nk->max_bytes_subkeyname = namelen * 2;
1911                 }
1912         }
1913
1914         /* write the values */
1915
1916         nk->values_off = REGF_OFFSET_NONE;
1917         if ( (nk->num_values = regval_ctr_numvals( values )) != 0 ) {
1918                 uint32 vlist_size = ( ( nk->num_values * sizeof(uint32) ) & 0xfffffff8 ) + 8;
1919                 int i;
1920
1921                 if (!(vlist_hbin = find_free_space( file, vlist_size ))) {
1922                         return NULL;
1923                 }
1924                 nk->values_off = prs_offset( &vlist_hbin->ps ) + vlist_hbin->first_hbin_off - HBIN_HDR_SIZE;
1925
1926                 if (nk->num_values) {
1927                         if ( !(nk->values = TALLOC_ARRAY( file->mem_ctx, REGF_VK_REC, nk->num_values )) )
1928                                 return NULL;
1929                 } else {
1930                         nk->values = NULL;
1931                 }
1932
1933                 /* create the vk records */
1934
1935                 for ( i=0; i<nk->num_values; i++ ) {
1936                         uint32 vk_size, namelen, datalen;
1937                         struct regval_blob *r;
1938
1939                         r = regval_ctr_specific_value( values, i );
1940                         create_vk_record( file, &nk->values[i], r );
1941                         vk_size = vk_record_data_size( &nk->values[i] );
1942                         nk->values[i].hbin = find_free_space( file, vk_size );
1943                         nk->values[i].hbin_off = prs_offset( &nk->values[i].hbin->ps );
1944                         nk->values[i].rec_size = ( vk_size - 1 ) ^ 0xFFFFFFFF;
1945                         nk->values[i].rec_off = prs_offset( &nk->values[i].hbin->ps )
1946                                 + nk->values[i].hbin->first_hbin_off
1947                                 - HBIN_HDR_SIZE;
1948
1949                         /* update the max bytes fields if necessary */
1950
1951                         namelen = strlen( regval_name(r) );
1952                         if ( namelen*2 > nk->max_bytes_valuename )
1953                                 nk->max_bytes_valuename = namelen * 2;
1954
1955                         datalen = regval_size( r );
1956                         if ( datalen > nk->max_bytes_value )
1957                                 nk->max_bytes_value = datalen;
1958                 }
1959         }
1960
1961         /* stream the records */
1962
1963         prs_set_offset( &nk->hbin->ps, nk->hbin_off );
1964         if ( !prs_nk_rec( "nk_rec", &nk->hbin->ps, 0, nk ) )
1965                 return False;
1966
1967         if ( nk->num_values ) {
1968                 if ( !hbin_prs_vk_records( "vk_records", vlist_hbin, 0, nk, file ) )
1969                         return False;
1970         }
1971
1972
1973         regfio_flush( file );
1974
1975         return nk;
1976 }
1977