source4/lib/registry/regf.c

   1 /*
   2    Samba CIFS implementation
   3    Registry backend for REGF files
   4    Copyright (C) 2005-2007 Jelmer Vernooij, jelmer@samba.org
   5    Copyright (C) 2006 Wilco Baan Hofman, wilco@baanhofman.nl
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include "system/time.h"
  23 #include "lib/registry/tdr_regf.h"
  24 #include "librpc/gen_ndr/ndr_security.h"
  25 #include "librpc/gen_ndr/winreg.h"
  26 #include "param/param.h"
  27 #include "lib/registry/registry.h"
  28 #include "libcli/security/security.h"
  29
  30
  31 static struct hive_operations reg_backend_regf;
  32
  33 /**
  34  * There are several places on the web where the REGF format is explained;
  35  *
  36  * TODO: Links
  37  */
  38
  39 /* TODO:
  40  *  - Return error codes that make more sense
  41  *  - Locking
  42  *  - do more things in-memory
  43  */
  44
  45 /*
  46  * Read HBIN blocks into memory
  47  */
  48
  49 struct regf_data {
  50         int fd;
  51         struct hbin_block **hbins;
  52         struct regf_hdr *header;
  53         struct smb_iconv_convenience *iconv_convenience;
  54 };
  55
  56 static WERROR regf_save_hbin(struct regf_data *data);
  57
  58 struct regf_key_data {
  59         struct hive_key key;
  60         struct regf_data *hive;
  61         uint32_t offset;
  62         struct nk_block *nk;
  63 };
  64
  65 static struct hbin_block *hbin_by_offset(const struct regf_data *data,
  66                                          uint32_t offset, uint32_t *rel_offset)
  67 {
  68         int i;
  69
  70         for (i = 0; data->hbins[i]; i++) {
  71                 if (offset >= data->hbins[i]->offset_from_first &&
  72                         offset < data->hbins[i]->offset_from_first+
  73                                          data->hbins[i]->offset_to_next) {
  74                         if (rel_offset != NULL)
  75                                 *rel_offset = offset - data->hbins[i]->offset_from_first - 0x20;
  76                         return data->hbins[i];
  77                 }
  78         }
  79
  80         return NULL;
  81 }
  82
  83 /**
  84  * Validate a regf header
  85  * For now, do nothing, but we should check the checksum
  86  */
  87 static uint32_t regf_hdr_checksum(const uint8_t *buffer)
  88 {
  89         uint32_t checksum = 0, x;
  90         int i;
  91
  92         for (i = 0; i < 0x01FB; i+= 4) {
  93                 x = IVAL(buffer, i);
  94                 checksum ^= x;
  95         }
  96
  97         return checksum;
  98 }
  99
 100 /**
 101  * Obtain the contents of a HBIN block
 102  */
 103 static DATA_BLOB hbin_get(const struct regf_data *data, uint32_t offset)
 104 {
 105         DATA_BLOB ret;
 106         struct hbin_block *hbin;
 107         uint32_t rel_offset;
 108
 109         ret.data = NULL;
 110         ret.length = 0;
 111
 112         hbin = hbin_by_offset(data, offset, &rel_offset);
 113
 114         if (hbin == NULL) {
 115                 DEBUG(1, ("Can't find HBIN containing 0x%04x\n", offset));
 116                 return ret;
 117         }
 118
 119         ret.length = IVAL(hbin->data, rel_offset);
 120         if (!(ret.length & 0x80000000)) {
 121                 DEBUG(0, ("Trying to use dirty block at 0x%04x\n", offset));
 122                 return ret;
 123         }
 124
 125         /* remove high bit */
 126         ret.length = (ret.length ^ 0xffffffff) + 1;
 127
 128         ret.length -= 4; /* 4 bytes for the length... */
 129         ret.data = hbin->data +
 130                 (offset - hbin->offset_from_first - 0x20) + 4;
 131
 132         return ret;
 133 }
 134
 135 static bool hbin_get_tdr(struct regf_data *regf, uint32_t offset,
 136                          TALLOC_CTX *ctx, tdr_pull_fn_t pull_fn, void *p)
 137 {
 138         struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
 139
 140         pull->data = hbin_get(regf, offset);
 141         if (!pull->data.data) {
 142                 DEBUG(1, ("Unable to get data at 0x%04x\n", offset));
 143                 talloc_free(pull);
 144                 return false;
 145         }
 146
 147         if (NT_STATUS_IS_ERR(pull_fn(pull, ctx, p))) {
 148                 DEBUG(1, ("Error parsing record at 0x%04x using tdr\n",
 149                         offset));
 150                 talloc_free(pull);
 151                 return false;
 152         }
 153         talloc_free(pull);
 154
 155         return true;
 156 }
 157
 158 /* Allocate some new data */
 159 static DATA_BLOB hbin_alloc(struct regf_data *data, uint32_t size,
 160                             uint32_t *offset)
 161 {
 162         DATA_BLOB ret;
 163         uint32_t rel_offset = -1; /* Relative offset ! */
 164         struct hbin_block *hbin = NULL;
 165         int i;
 166
 167         *offset = 0;
 168
 169         if (size == 0)
 170                 return data_blob(NULL, 0);
 171
 172         size += 4; /* Need to include int32 for the length */
 173
 174         /* Allocate as a multiple of 8 */
 175         size = (size + 7) & ~7;
 176
 177         ret.data = NULL;
 178         ret.length = 0;
 179
 180         for (i = 0; (hbin = data->hbins[i]); i++) {
 181                 int j;
 182                 int32_t my_size;
 183                 for (j = 0; j < hbin->offset_to_next-0x20; j+= my_size) {
 184                         my_size = IVALS(hbin->data, j);
 185
 186                         if (my_size == 0x0) {
 187                                 DEBUG(0, ("Invalid zero-length block! File is corrupt.\n"));
 188                                 return ret;
 189                         }
 190
 191                         if (my_size % 8 != 0) {
 192                                 DEBUG(0, ("Encountered non-aligned block!\n"));
 193                         }
 194
 195                         if (my_size < 0) { /* Used... */
 196                                 my_size = -my_size;
 197                         } else if (my_size == size) { /* exact match */
 198                                 rel_offset = j;
 199                                 DEBUG(4, ("Found free block of exact size %d in middle of HBIN\n",
 200                                         size));
 201                                 break;
 202                         } else if (my_size > size) { /* data will remain */
 203                                 rel_offset = j;
 204                                 /* Split this block and mark the next block as free */
 205                                 SIVAL(hbin->data, rel_offset+size, my_size-size);
 206                                 DEBUG(4, ("Found free block of size %d (needing %d) in middle of HBIN\n",
 207                                         my_size, size));
 208                                 break;
 209                         }
 210                 }
 211
 212                 if (rel_offset != -1)
 213                         break;
 214         }
 215
 216         /* No space available in previous hbins,
 217          * allocate new one */
 218         if (data->hbins[i] == NULL) {
 219                 DEBUG(4, ("No space available in other HBINs for block of size %d, allocating new HBIN\n",
 220                         size));
 221                 data->hbins = talloc_realloc(data, data->hbins,
 222                                              struct hbin_block *, i+2);
 223                 hbin = talloc(data->hbins, struct hbin_block);
 224                 SMB_ASSERT(hbin != NULL);
 225
 226                 data->hbins[i] = hbin;
 227                 data->hbins[i+1] = NULL;
 228
 229                 hbin->HBIN_ID = talloc_strdup(hbin, "hbin");
 230                 hbin->offset_from_first = (i == 0?0:data->hbins[i-1]->offset_from_first+data->hbins[i-1]->offset_to_next);
 231                 hbin->offset_to_next = 0x1000;
 232                 hbin->unknown[0] = 0;
 233                 hbin->unknown[0] = 0;
 234                 unix_to_nt_time(&hbin->last_change, time(NULL));
 235                 hbin->block_size = hbin->offset_to_next;
 236                 hbin->data = talloc_zero_array(hbin, uint8_t, hbin->block_size - 0x20);
 237
 238                 rel_offset = 0x0;
 239                 SIVAL(hbin->data, size, hbin->block_size - size - 0x20);
 240         }
 241
 242         /* Set size and mark as used */
 243         SIVAL(hbin->data, rel_offset, -size);
 244
 245         ret.data = hbin->data + rel_offset + 0x4; /* Skip past length */
 246         ret.length = size - 0x4;
 247         if (offset) {
 248                 uint32_t new_rel_offset;
 249                 *offset = hbin->offset_from_first + rel_offset + 0x20;
 250                 SMB_ASSERT(hbin_by_offset(data, *offset, &new_rel_offset) == hbin);
 251                 SMB_ASSERT(new_rel_offset == rel_offset);
 252         }
 253
 254         return ret;
 255 }
 256
 257 /* Store a data blob. Return the offset at which it was stored */
 258 static uint32_t hbin_store (struct regf_data *data, DATA_BLOB blob)
 259 {
 260         uint32_t ret;
 261         DATA_BLOB dest = hbin_alloc(data, blob.length, &ret);
 262
 263         memcpy(dest.data, blob.data, blob.length);
 264
 265         return ret;
 266 }
 267
 268 static uint32_t hbin_store_tdr(struct regf_data *data,
 269                                tdr_push_fn_t push_fn, void *p)
 270 {
 271         struct tdr_push *push = tdr_push_init(data, data->iconv_convenience);
 272         uint32_t ret;
 273
 274         if (NT_STATUS_IS_ERR(push_fn(push, p))) {
 275                 DEBUG(0, ("Error during push\n"));
 276                 return -1;
 277         }
 278
 279         ret = hbin_store(data, push->data);
 280
 281         talloc_free(push);
 282
 283         return ret;
 284 }
 285
 286
 287 /* Free existing data */
 288 static void hbin_free (struct regf_data *data, uint32_t offset)
 289 {
 290         int32_t size;
 291         uint32_t rel_offset;
 292         int32_t next_size;
 293         struct hbin_block *hbin;
 294
 295         SMB_ASSERT (offset > 0);
 296
 297         hbin = hbin_by_offset(data, offset, &rel_offset);
 298
 299         if (hbin == NULL)
 300                 return;
 301
 302         /* Get original size */
 303         size = IVALS(hbin->data, rel_offset);
 304
 305         if (size > 0) {
 306                 DEBUG(1, ("Trying to free already freed block at 0x%04x\n",
 307                         offset));
 308                 return;
 309         }
 310         /* Mark as unused */
 311         size = -size;
 312
 313         /* If the next block is free, merge into big free block */
 314         if (rel_offset + size < hbin->offset_to_next) {
 315                 next_size = IVALS(hbin->data, rel_offset+size);
 316                 if (next_size > 0) {
 317                         size += next_size;
 318                 }
 319         }
 320
 321         /* Write block size */
 322         SIVALS(hbin->data, rel_offset, size);
 323 }
 324
 325 /**
 326  * Store a data blob data was already stored, but has changed in size
 327  * Will try to save it at the current location if possible, otherwise
 328  * does a free + store */
 329 static uint32_t hbin_store_resize(struct regf_data *data,
 330                                   uint32_t orig_offset, DATA_BLOB blob)
 331 {
 332         uint32_t rel_offset;
 333         struct hbin_block *hbin = hbin_by_offset(data, orig_offset,
 334                                                  &rel_offset);
 335         int32_t my_size;
 336         int32_t orig_size;
 337         int32_t needed_size;
 338         int32_t possible_size;
 339         int i;
 340
 341         SMB_ASSERT(orig_offset > 0);
 342
 343         if (!hbin)
 344                 return hbin_store(data, blob);
 345
 346         /* Get original size */
 347         orig_size = -IVALS(hbin->data, rel_offset);
 348
 349         needed_size = blob.length + 4; /* Add int32 containing length */
 350         needed_size = (needed_size + 7) & ~7; /* Align */
 351
 352         /* Fits into current allocated block */
 353         if (orig_size >= needed_size) {
 354                 memcpy(hbin->data + rel_offset + 0x4, blob.data, blob.length);
 355                 /* If the difference in size is greater than 0x4, split the block
 356                  * and free/merge it */
 357                 if (orig_size - needed_size > 0x4) {
 358                         SIVALS(hbin->data, rel_offset, -needed_size);
 359                         SIVALS(hbin->data, rel_offset + needed_size,
 360                                needed_size-orig_size);
 361                         hbin_free(data, orig_offset + needed_size);
 362                 }
 363                 return orig_offset;
 364         }
 365
 366         possible_size = orig_size;
 367
 368         /* Check if it can be combined with the next few free records */
 369         for (i = rel_offset; i < hbin->offset_to_next - 0x20; i += my_size) {
 370                 if (IVALS(hbin->data, i) < 0) /* Used */
 371                         break;
 372
 373                 my_size = IVALS(hbin->data, i);
 374
 375                 if (my_size == 0x0) {
 376                         DEBUG(0, ("Invalid zero-length block! File is corrupt.\n"));
 377                         break;
 378                 } else {
 379                         possible_size += my_size;
 380                 }
 381
 382                 if (possible_size >= blob.length) {
 383                         SIVAL(hbin->data, rel_offset, -possible_size);
 384                         memcpy(hbin->data + rel_offset + 0x4,
 385                                blob.data, blob.length);
 386                         return orig_offset;
 387                 }
 388         }
 389
 390         hbin_free(data, orig_offset);
 391         return hbin_store(data, blob);
 392 }
 393
 394 static uint32_t hbin_store_tdr_resize(struct regf_data *regf,
 395                                       tdr_push_fn_t push_fn,
 396                                       uint32_t orig_offset, void *p)
 397 {
 398         struct tdr_push *push = tdr_push_init(regf, regf->iconv_convenience);
 399         uint32_t ret;
 400
 401         if (NT_STATUS_IS_ERR(push_fn(push, p))) {
 402                 DEBUG(0, ("Error during push\n"));
 403                 return -1;
 404         }
 405
 406         ret = hbin_store_resize(regf, orig_offset, push->data);
 407
 408         talloc_free(push);
 409
 410         return ret;
 411 }
 412
 413 static uint32_t regf_create_lh_hash(const char *name)
 414 {
 415         char *hash_name;
 416         uint32_t ret = 0;
 417         uint16_t i;
 418
 419         hash_name = strupper_talloc(NULL, name);
 420         for (i = 0; *(hash_name + i) != 0; i++) {
 421                 ret *= 37;
 422                 ret += *(hash_name + i);
 423         }
 424         talloc_free(hash_name);
 425         return ret;
 426 }
 427
 428 static WERROR regf_get_info(TALLOC_CTX *mem_ctx,
 429                             const struct hive_key *key,
 430                             const char **classname,
 431                             uint32_t *num_subkeys,
 432                             uint32_t *num_values,
 433                             NTTIME *last_mod_time,
 434                             uint32_t *max_subkeynamelen,
 435                             uint32_t *max_valnamelen,
 436                             uint32_t *max_valbufsize)
 437 {
 438         const struct regf_key_data *private_data =
 439                 (const struct regf_key_data *)key;
 440
 441         if (num_subkeys != NULL)
 442                 *num_subkeys = private_data->nk->num_subkeys;
 443
 444         if (num_values != NULL)
 445                 *num_values = private_data->nk->num_values;
 446
 447         if (classname != NULL) {
 448                 if (private_data->nk->clsname_offset != -1) {
 449                         DATA_BLOB data = hbin_get(private_data->hive,
 450                                                   private_data->nk->clsname_offset);
 451                         *classname = talloc_strndup(mem_ctx,
 452                                                     (char*)data.data,
 453                                                     private_data->nk->clsname_length);
 454                 } else
 455                         *classname = NULL;
 456         }
 457
 458         /* TODO: Last mod time */
 459
 460         /* TODO: max valnamelen */
 461
 462         /* TODO: max valbufsize */
 463
 464         /* TODO: max subkeynamelen */
 465
 466         return WERR_OK;
 467 }
 468
 469 static struct regf_key_data *regf_get_key(TALLOC_CTX *ctx,
 470                                           struct regf_data *regf,
 471                                           uint32_t offset)
 472 {
 473         struct nk_block *nk;
 474         struct regf_key_data *ret;
 475
 476         ret = talloc_zero(ctx, struct regf_key_data);
 477         ret->key.ops = &reg_backend_regf;
 478         ret->hive = talloc_reference(ret, regf);
 479         ret->offset = offset;
 480         nk = talloc(ret, struct nk_block);
 481         if (nk == NULL)
 482                 return NULL;
 483
 484         ret->nk = nk;
 485
 486         if (!hbin_get_tdr(regf, offset, nk,
 487                           (tdr_pull_fn_t)tdr_pull_nk_block, nk)) {
 488                 DEBUG(0, ("Unable to find HBIN data for offset %d\n", offset));
 489                 return NULL;
 490         }
 491
 492         if (strcmp(nk->header, "nk") != 0) {
 493                 DEBUG(0, ("Expected nk record, got %s\n", nk->header));
 494                 talloc_free(ret);
 495                 return NULL;
 496         }
 497
 498         return ret;
 499 }
 500
 501
 502 static WERROR regf_get_value(TALLOC_CTX *ctx, struct hive_key *key,
 503                              int idx, const char **name,
 504                              uint32_t *data_type, DATA_BLOB *data)
 505 {
 506         const struct regf_key_data *private_data =
 507                         (const struct regf_key_data *)key;
 508         struct vk_block *vk;
 509         struct regf_data *regf = private_data->hive;
 510         uint32_t vk_offset;
 511         DATA_BLOB tmp;
 512
 513         if (idx >= private_data->nk->num_values)
 514                 return WERR_NO_MORE_ITEMS;
 515
 516         tmp = hbin_get(regf, private_data->nk->values_offset);
 517         if (!tmp.data) {
 518                 DEBUG(0, ("Unable to find value list\n"));
 519                 return WERR_GENERAL_FAILURE;
 520         }
 521
 522         if (tmp.length < private_data->nk->num_values * 4) {
 523                 DEBUG(1, ("Value counts mismatch\n"));
 524         }
 525
 526         vk_offset = IVAL(tmp.data, idx * 4);
 527
 528         vk = talloc(NULL, struct vk_block);
 529         W_ERROR_HAVE_NO_MEMORY(vk);
 530
 531         if (!hbin_get_tdr(regf, vk_offset, vk,
 532                           (tdr_pull_fn_t)tdr_pull_vk_block, vk)) {
 533                 DEBUG(0, ("Unable to get VK block at %d\n", vk_offset));
 534                 talloc_free(vk);
 535                 return WERR_GENERAL_FAILURE;
 536         }
 537
 538         /* FIXME: name character set ?*/
 539         if (name != NULL)
 540                 *name = talloc_strndup(ctx, vk->data_name, vk->name_length);
 541
 542         if (data_type != NULL)
 543                 *data_type = vk->data_type;
 544
 545         if (vk->data_length & 0x80000000) {
 546                 vk->data_length &=~0x80000000;
 547                 data->data = (uint8_t *)&vk->data_offset;
 548                 data->length = vk->data_length;
 549         } else {
 550                 *data = hbin_get(regf, vk->data_offset);
 551         }
 552
 553         if (data->length < vk->data_length) {
 554                 DEBUG(1, ("Read data less than indicated data length!\n"));
 555         }
 556
 557         talloc_free(vk);
 558
 559         return WERR_OK;
 560 }
 561
 562 static WERROR regf_get_value_by_name(TALLOC_CTX *mem_ctx,
 563                                      struct hive_key *key, const char *name,
 564                                      uint32_t *type, DATA_BLOB *data)
 565 {
 566         int i;
 567         const char *vname;
 568         WERROR error;
 569
 570         /* FIXME: Do binary search? Is this list sorted at all? */
 571
 572         for (i = 0; W_ERROR_IS_OK(error = regf_get_value(mem_ctx, key, i,
 573                                                          &vname, type, data));
 574                                                          i++) {
 575                 if (!strcmp(vname, name))
 576                         return WERR_OK;
 577         }
 578
 579         if (W_ERROR_EQUAL(error, WERR_NO_MORE_ITEMS))
 580                 return WERR_BADFILE;
 581
 582         return error;
 583 }
 584
 585
 586 static WERROR regf_get_subkey_by_index(TALLOC_CTX *ctx,
 587                                        const struct hive_key *key,
 588                                        uint32_t idx, const char **name,
 589                                        const char **classname,
 590                                        NTTIME *last_mod_time)
 591 {
 592         DATA_BLOB data;
 593         struct regf_key_data *ret;
 594         const struct regf_key_data *private_data = (const struct regf_key_data *)key;
 595         struct nk_block *nk = private_data->nk;
 596         uint32_t key_off=0;
 597
 598         if (idx >= nk->num_subkeys)
 599                 return WERR_NO_MORE_ITEMS;
 600
 601         data = hbin_get(private_data->hive, nk->subkeys_offset);
 602         if (!data.data) {
 603                 DEBUG(0, ("Unable to find subkey list\n"));
 604                 return WERR_GENERAL_FAILURE;
 605         }
 606
 607         if (!strncmp((char *)data.data, "li", 2)) {
 608                 struct li_block li;
 609                 struct tdr_pull *pull = tdr_pull_init(private_data->hive, private_data->hive->iconv_convenience);
 610
 611                 DEBUG(10, ("Subkeys in LI list\n"));
 612                 pull->data = data;
 613
 614                 if (NT_STATUS_IS_ERR(tdr_pull_li_block(pull, nk, &li))) {
 615                         DEBUG(0, ("Error parsing LI list\n"));
 616                         talloc_free(pull);
 617                         return WERR_GENERAL_FAILURE;
 618                 }
 619                 talloc_free(pull);
 620                 SMB_ASSERT(!strncmp(li.header, "li", 2));
 621
 622                 if (li.key_count != nk->num_subkeys) {
 623                         DEBUG(0, ("Subkey counts don't match\n"));
 624                         return WERR_GENERAL_FAILURE;
 625                 }
 626                 key_off = li.nk_offset[idx];
 627
 628         } else if (!strncmp((char *)data.data, "lf", 2)) {
 629                 struct lf_block lf;
 630                 struct tdr_pull *pull = tdr_pull_init(private_data->hive, private_data->hive->iconv_convenience);
 631
 632                 DEBUG(10, ("Subkeys in LF list\n"));
 633                 pull->data = data;
 634
 635                 if (NT_STATUS_IS_ERR(tdr_pull_lf_block(pull, nk, &lf))) {
 636                         DEBUG(0, ("Error parsing LF list\n"));
 637                         talloc_free(pull);
 638                         return WERR_GENERAL_FAILURE;
 639                 }
 640                 talloc_free(pull);
 641                 SMB_ASSERT(!strncmp(lf.header, "lf", 2));
 642
 643                 if (lf.key_count != nk->num_subkeys) {
 644                         DEBUG(0, ("Subkey counts don't match\n"));
 645                         return WERR_GENERAL_FAILURE;
 646                 }
 647
 648                 key_off = lf.hr[idx].nk_offset;
 649         } else if (!strncmp((char *)data.data, "lh", 2)) {
 650                 struct lh_block lh;
 651                 struct tdr_pull *pull = tdr_pull_init(private_data->hive, private_data->hive->iconv_convenience);
 652
 653                 DEBUG(10, ("Subkeys in LH list\n"));
 654                 pull->data = data;
 655
 656                 if (NT_STATUS_IS_ERR(tdr_pull_lh_block(pull, nk, &lh))) {
 657                         DEBUG(0, ("Error parsing LH list\n"));
 658                         talloc_free(pull);
 659                         return WERR_GENERAL_FAILURE;
 660                 }
 661                 talloc_free(pull);
 662                 SMB_ASSERT(!strncmp(lh.header, "lh", 2));
 663
 664                 if (lh.key_count != nk->num_subkeys) {
 665                         DEBUG(0, ("Subkey counts don't match\n"));
 666                         return WERR_GENERAL_FAILURE;
 667                 }
 668                 key_off = lh.hr[idx].nk_offset;
 669         } else if (!strncmp((char *)data.data, "ri", 2)) {
 670                 struct ri_block ri;
 671                 struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
 672                 uint16_t i;
 673                 uint16_t sublist_count = 0;
 674
 675                 DEBUG(10, ("Subkeys in RI list\n"));
 676                 pull->data = data;
 677
 678                 if (NT_STATUS_IS_ERR(tdr_pull_ri_block(pull, nk, &ri))) {
 679                         DEBUG(0, ("Error parsing RI list\n"));
 680                         talloc_free(pull);
 681                         return WERR_GENERAL_FAILURE;
 682                 }
 683                 SMB_ASSERT(!strncmp(ri.header, "ri", 2));
 684
 685                 for (i = 0; i < ri.key_count; i++) {
 686                         DATA_BLOB list_data;
 687
 688                         /* Get sublist data blob */
 689                         list_data = hbin_get(private_data->hive, ri.offset[i]);
 690                         if (!list_data.data) {
 691                                 DEBUG(0, ("Error getting RI list."));
 692                                 talloc_free(pull);
 693                                 return WERR_GENERAL_FAILURE;
 694                         }
 695
 696                         pull->data = list_data;
 697
 698                         if (!strncmp((char *)list_data.data, "li", 2)) {
 699                                 struct li_block li;
 700
 701                                 DEBUG(10, ("Subkeys in RI->LI list\n"));
 702
 703                                 if (NT_STATUS_IS_ERR(tdr_pull_li_block(pull,
 704                                                                        nk,
 705                                                                        &li))) {
 706                                         DEBUG(0, ("Error parsing LI list from RI\n"));
 707                                         talloc_free(pull);
 708                                         return WERR_GENERAL_FAILURE;
 709                                 }
 710                                 SMB_ASSERT(!strncmp(li.header, "li", 2));
 711
 712                                 /* Advance to next sublist if necessary */
 713                                 if (idx >= sublist_count + li.key_count) {
 714                                         sublist_count += li.key_count;
 715                                         continue;
 716                                 }
 717                                 key_off = li.nk_offset[idx - sublist_count];
 718                                 sublist_count += li.key_count;
 719                                 break;
 720                         } else if (!strncmp((char *)list_data.data, "lh", 2)) {
 721                                 struct lh_block lh;
 722
 723                                 DEBUG(10, ("Subkeys in RI->LH list\n"));
 724
 725                                 if (NT_STATUS_IS_ERR(tdr_pull_lh_block(pull,
 726                                                                        nk,
 727                                                                        &lh))) {
 728                                         DEBUG(0, ("Error parsing LH list from RI\n"));
 729                                         talloc_free(pull);
 730                                         return WERR_GENERAL_FAILURE;
 731                                 }
 732                                 SMB_ASSERT(!strncmp(lh.header, "lh", 2));
 733
 734                                 /* Advance to next sublist if necessary */
 735                                 if (idx >= sublist_count + lh.key_count) {
 736                                         sublist_count += lh.key_count;
 737                                         continue;
 738                                 }
 739                                 key_off = lh.hr[idx - sublist_count].nk_offset;
 740                                 sublist_count += lh.key_count;
 741                                 break;
 742                         } else {
 743                                 DEBUG(0,("Unknown sublist in ri block\n"));
 744                                 talloc_free(pull);
 745
 746                                 return WERR_GENERAL_FAILURE;
 747                         }
 748
 749                 }
 750                 talloc_free(pull);
 751
 752
 753                 if (idx > sublist_count) {
 754                         return WERR_NO_MORE_ITEMS;
 755                 }
 756
 757         } else {
 758                 DEBUG(0, ("Unknown type for subkey list (0x%04x): %c%c\n",
 759                                   nk->subkeys_offset, data.data[0], data.data[1]));
 760                 return WERR_GENERAL_FAILURE;
 761         }
 762
 763         ret = regf_get_key (ctx, private_data->hive, key_off);
 764
 765         if (classname != NULL) {
 766                 if (ret->nk->clsname_offset != -1) {
 767                         DATA_BLOB db = hbin_get(ret->hive,
 768                                                 ret->nk->clsname_offset);
 769                         *classname = talloc_strndup(ctx,
 770                                                     (char*)db.data,
 771                                                     ret->nk->clsname_length);
 772                 } else
 773                         *classname = NULL;
 774         }
 775
 776         if (last_mod_time != NULL)
 777                 *last_mod_time = ret->nk->last_change;
 778
 779         if (name != NULL)
 780                 *name = talloc_steal(ctx, ret->nk->key_name);
 781
 782         talloc_free(ret);
 783
 784         return WERR_OK;
 785 }
 786
 787 static WERROR regf_match_subkey_by_name(TALLOC_CTX *ctx,
 788                                         const struct hive_key *key,
 789                                         uint32_t offset,
 790                                         const char *name, uint32_t *ret)
 791 {
 792         DATA_BLOB subkey_data;
 793         struct nk_block subkey;
 794         struct tdr_pull *pull;
 795         const struct regf_key_data *private_data =
 796                 (const struct regf_key_data *)key;
 797
 798         subkey_data = hbin_get(private_data->hive, offset);
 799         if (!subkey_data.data) {
 800                 DEBUG(0, ("Unable to retrieve subkey HBIN\n"));
 801                 return WERR_GENERAL_FAILURE;
 802         }
 803
 804         pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
 805
 806         pull->data = subkey_data;
 807
 808         if (NT_STATUS_IS_ERR(tdr_pull_nk_block(pull, ctx, &subkey))) {
 809                 DEBUG(0, ("Error parsing NK structure.\n"));
 810                 talloc_free(pull);
 811                 return WERR_GENERAL_FAILURE;
 812         }
 813         talloc_free(pull);
 814
 815         if (strncmp(subkey.header, "nk", 2)) {
 816                 DEBUG(0, ("Not an NK structure.\n"));
 817                 return WERR_GENERAL_FAILURE;
 818         }
 819
 820         if (!strcasecmp(subkey.key_name, name)) {
 821                 *ret = offset;
 822         } else {
 823                 *ret = 0;
 824         }
 825         return WERR_OK;
 826 }
 827
 828 static WERROR regf_get_subkey_by_name(TALLOC_CTX *ctx,
 829                                       const struct hive_key *key,
 830                                       const char *name,
 831                                       struct hive_key **ret)
 832 {
 833         DATA_BLOB data;
 834         const struct regf_key_data *private_data =
 835                 (const struct regf_key_data *)key;
 836         struct nk_block *nk = private_data->nk;
 837         uint32_t key_off = 0;
 838
 839         data = hbin_get(private_data->hive, nk->subkeys_offset);
 840         if (!data.data) {
 841                 DEBUG(0, ("Unable to find subkey list\n"));
 842                 return WERR_GENERAL_FAILURE;
 843         }
 844
 845         if (!strncmp((char *)data.data, "li", 2)) {
 846                 struct li_block li;
 847                 struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
 848                 uint16_t i;
 849
 850                 DEBUG(10, ("Subkeys in LI list\n"));
 851                 pull->data = data;
 852
 853                 if (NT_STATUS_IS_ERR(tdr_pull_li_block(pull, nk, &li))) {
 854                         DEBUG(0, ("Error parsing LI list\n"));
 855                         talloc_free(pull);
 856                         return WERR_GENERAL_FAILURE;
 857                 }
 858                 talloc_free(pull);
 859                 SMB_ASSERT(!strncmp(li.header, "li", 2));
 860
 861                 if (li.key_count != nk->num_subkeys) {
 862                         DEBUG(0, ("Subkey counts don't match\n"));
 863                         return WERR_GENERAL_FAILURE;
 864                 }
 865
 866                 for (i = 0; i < li.key_count; i++) {
 867                         W_ERROR_NOT_OK_RETURN(regf_match_subkey_by_name(nk, key,
 868                                                                         li.nk_offset[i],
 869                                                                         name,
 870                                                                         &key_off));
 871                         if (key_off != 0)
 872                                 break;
 873                 }
 874                 if (key_off == 0)
 875                         return WERR_BADFILE;
 876         } else if (!strncmp((char *)data.data, "lf", 2)) {
 877                 struct lf_block lf;
 878                 struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
 879                 uint16_t i;
 880
 881                 DEBUG(10, ("Subkeys in LF list\n"));
 882                 pull->data = data;
 883
 884                 if (NT_STATUS_IS_ERR(tdr_pull_lf_block(pull, nk, &lf))) {
 885                         DEBUG(0, ("Error parsing LF list\n"));
 886                         talloc_free(pull);
 887                         return WERR_GENERAL_FAILURE;
 888                 }
 889                 talloc_free(pull);
 890                 SMB_ASSERT(!strncmp(lf.header, "lf", 2));
 891
 892                 if (lf.key_count != nk->num_subkeys) {
 893                         DEBUG(0, ("Subkey counts don't match\n"));
 894                         return WERR_GENERAL_FAILURE;
 895                 }
 896
 897                 for (i = 0; i < lf.key_count; i++) {
 898                         if (strncmp(lf.hr[i].hash, name, 4)) {
 899                                 continue;
 900                         }
 901                         W_ERROR_NOT_OK_RETURN(regf_match_subkey_by_name(nk,
 902                                                                         key,
 903                                                                         lf.hr[i].nk_offset,
 904                                                                         name,
 905                                                                         &key_off));
 906                         if (key_off != 0)
 907                                 break;
 908                 }
 909                 if (key_off == 0)
 910                         return WERR_BADFILE;
 911         } else if (!strncmp((char *)data.data, "lh", 2)) {
 912                 struct lh_block lh;
 913                 struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
 914                 uint16_t i;
 915                 uint32_t hash;
 916
 917                 DEBUG(10, ("Subkeys in LH list\n"));
 918                 pull->data = data;
 919
 920                 if (NT_STATUS_IS_ERR(tdr_pull_lh_block(pull, nk, &lh))) {
 921                         DEBUG(0, ("Error parsing LH list\n"));
 922                         talloc_free(pull);
 923                         return WERR_GENERAL_FAILURE;
 924                 }
 925                 talloc_free(pull);
 926                 SMB_ASSERT(!strncmp(lh.header, "lh", 2));
 927
 928                 if (lh.key_count != nk->num_subkeys) {
 929                         DEBUG(0, ("Subkey counts don't match\n"));
 930                         return WERR_GENERAL_FAILURE;
 931                 }
 932
 933                 hash = regf_create_lh_hash(name);
 934                 for (i = 0; i < lh.key_count; i++) {
 935                         if (lh.hr[i].base37 != hash) {
 936                                 continue;
 937                         }
 938                         W_ERROR_NOT_OK_RETURN(regf_match_subkey_by_name(nk,
 939                                                                         key,
 940                                                                         lh.hr[i].nk_offset,
 941                                                                         name,
 942                                                                         &key_off));
 943                         if (key_off != 0)
 944                                 break;
 945                 }
 946                 if (key_off == 0)
 947                         return WERR_BADFILE;
 948         } else if (!strncmp((char *)data.data, "ri", 2)) {
 949                 struct ri_block ri;
 950                 struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
 951                 uint16_t i, j;
 952
 953                 DEBUG(10, ("Subkeys in RI list\n"));
 954                 pull->data = data;
 955
 956                 if (NT_STATUS_IS_ERR(tdr_pull_ri_block(pull, nk, &ri))) {
 957                         DEBUG(0, ("Error parsing RI list\n"));
 958                         talloc_free(pull);
 959                         return WERR_GENERAL_FAILURE;
 960                 }
 961                 SMB_ASSERT(!strncmp(ri.header, "ri", 2));
 962
 963                 for (i = 0; i < ri.key_count; i++) {
 964                         DATA_BLOB list_data;
 965
 966                         /* Get sublist data blob */
 967                         list_data = hbin_get(private_data->hive, ri.offset[i]);
 968                         if (list_data.data == NULL) {
 969                                 DEBUG(0, ("Error getting RI list."));
 970                                 talloc_free(pull);
 971                                 return WERR_GENERAL_FAILURE;
 972                         }
 973
 974                         pull->data = list_data;
 975
 976                         if (!strncmp((char *)list_data.data, "li", 2)) {
 977                                 struct li_block li;
 978
 979                                 if (NT_STATUS_IS_ERR(tdr_pull_li_block(pull,
 980                                                                        nk,
 981                                                                        &li))) {
 982                                         DEBUG(0, ("Error parsing LI list from RI\n"));
 983                                         talloc_free(pull);
 984                                         return WERR_GENERAL_FAILURE;
 985                                 }
 986                                 SMB_ASSERT(!strncmp(li.header, "li", 2));
 987
 988                                 for (j = 0; j < li.key_count; j++) {
 989                                         W_ERROR_NOT_OK_RETURN(regf_match_subkey_by_name(nk, key,
 990                                                                                         li.nk_offset[j],
 991                                                                                         name,
 992                                                                                         &key_off));
 993                                         if (key_off)
 994                                                 break;
 995                                 }
 996                         } else if (!strncmp((char *)list_data.data, "lh", 2)) {
 997                                 struct lh_block lh;
 998                                 uint32_t hash;
 999
1000                                 if (NT_STATUS_IS_ERR(tdr_pull_lh_block(pull,
1001                                                                        nk,
1002                                                                        &lh))) {
1003                                         DEBUG(0, ("Error parsing LH list from RI\n"));
1004                                         talloc_free(pull);
1005                                         return WERR_GENERAL_FAILURE;
1006                                 }
1007                                 SMB_ASSERT(!strncmp(lh.header, "lh", 2));
1008
1009                                 hash = regf_create_lh_hash(name);
1010                                 for (j = 0; j < lh.key_count; j++) {
1011                                         if (lh.hr[j].base37 != hash) {
1012                                                 continue;
1013                                         }
1014                                         W_ERROR_NOT_OK_RETURN(regf_match_subkey_by_name(nk, key,
1015                                                                                         lh.hr[j].nk_offset,
1016                                                                                         name,
1017                                                                                         &key_off));
1018                                         if (key_off)
1019                                                 break;
1020                                 }
1021                         }
1022                         if (key_off)
1023                                 break;
1024                 }
1025                 talloc_free(pull);
1026                 if (!key_off)
1027                         return WERR_BADFILE;
1028         } else {
1029                 DEBUG(0, ("Unknown subkey list type.\n"));
1030                 return WERR_GENERAL_FAILURE;
1031         }
1032
1033         *ret = (struct hive_key *)regf_get_key(ctx, private_data->hive,
1034                                                key_off);
1035         return WERR_OK;
1036 }
1037
1038 static WERROR regf_set_sec_desc(struct hive_key *key,
1039                                 const struct security_descriptor *sec_desc)
1040 {
1041         const struct regf_key_data *private_data =
1042                 (const struct regf_key_data *)key;
1043         struct sk_block cur_sk, sk, new_sk;
1044         struct regf_data *regf = private_data->hive;
1045         struct nk_block root;
1046         DATA_BLOB data;
1047         uint32_t sk_offset, cur_sk_offset;
1048         bool update_cur_sk = false;
1049
1050         /* Get the root nk */
1051         hbin_get_tdr(regf, regf->header->data_offset, regf,
1052                      (tdr_pull_fn_t) tdr_pull_nk_block, &root);
1053
1054         /* Push the security descriptor to a blob */
1055         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(&data, regf, NULL,
1056                                                           sec_desc, (ndr_push_flags_fn_t)ndr_push_security_descriptor))) {
1057                 DEBUG(0, ("Unable to push security descriptor\n"));
1058                 return WERR_GENERAL_FAILURE;
1059         }
1060
1061         /* Get the current security descriptor for the key */
1062         if (!hbin_get_tdr(regf, private_data->nk->sk_offset, regf,
1063                           (tdr_pull_fn_t) tdr_pull_sk_block, &cur_sk)) {
1064                 DEBUG(0, ("Unable to find security descriptor for current key\n"));
1065                 return WERR_BADFILE;
1066         }
1067         /* If there's no change, change nothing. */
1068         if (memcmp(data.data, cur_sk.sec_desc,
1069                    MIN(data.length, cur_sk.rec_size)) == 0) {
1070                 return WERR_OK;
1071         }
1072
1073         /* Delete the current sk if only this key is using it */
1074         if (cur_sk.ref_cnt == 1) {
1075                 /* Get the previous security descriptor for the key */
1076                 if (!hbin_get_tdr(regf, cur_sk.prev_offset, regf,
1077                                   (tdr_pull_fn_t) tdr_pull_sk_block, &sk)) {
1078                         DEBUG(0, ("Unable to find prev security descriptor for current key\n"));
1079                         return WERR_BADFILE;
1080                 }
1081                 /* Change and store the previous security descriptor */
1082                 sk.next_offset = cur_sk.next_offset;
1083                 hbin_store_tdr_resize(regf, (tdr_push_fn_t) tdr_push_sk_block,
1084                                       cur_sk.prev_offset, &sk);
1085
1086                 /* Get the next security descriptor for the key */
1087                 if (!hbin_get_tdr(regf, cur_sk.next_offset, regf,
1088                                   (tdr_pull_fn_t) tdr_pull_sk_block, &sk)) {
1089                         DEBUG(0, ("Unable to find next security descriptor for current key\n"));
1090                         return WERR_BADFILE;
1091                 }
1092                 /* Change and store the next security descriptor */
1093                 sk.prev_offset = cur_sk.prev_offset;
1094                 hbin_store_tdr_resize(regf, (tdr_push_fn_t) tdr_push_sk_block,
1095                                       cur_sk.next_offset, &sk);
1096
1097                 hbin_free(regf, private_data->nk->sk_offset);
1098         } else {
1099                 /* This key will no longer be referring to this sk */
1100                 cur_sk.ref_cnt--;
1101                 update_cur_sk = true;
1102         }
1103
1104         sk_offset = root.sk_offset;
1105
1106         do {
1107                 cur_sk_offset = sk_offset;
1108                 if (!hbin_get_tdr(regf, sk_offset, regf,
1109                                   (tdr_pull_fn_t) tdr_pull_sk_block, &sk)) {
1110                         DEBUG(0, ("Unable to find security descriptor\n"));
1111                         return WERR_BADFILE;
1112                 }
1113                 if (memcmp(data.data, sk.sec_desc, MIN(data.length, sk.rec_size)) == 0) {
1114                         private_data->nk->sk_offset = sk_offset;
1115                         sk.ref_cnt++;
1116                         hbin_store_tdr_resize(regf,
1117                                               (tdr_push_fn_t) tdr_push_sk_block,
1118                                               sk_offset, &sk);
1119                         hbin_store_tdr_resize(regf,
1120                                               (tdr_push_fn_t) tdr_push_nk_block,
1121                                               private_data->offset,
1122                                               private_data->nk);
1123                         return WERR_OK;
1124                 }
1125                 sk_offset = sk.next_offset;
1126         } while (sk_offset != root.sk_offset);
1127
1128         ZERO_STRUCT(new_sk);
1129         new_sk.header = "sk";
1130         new_sk.prev_offset = cur_sk_offset;
1131         new_sk.next_offset = root.sk_offset;
1132         new_sk.ref_cnt = 1;
1133         new_sk.rec_size = data.length;
1134         new_sk.sec_desc = data.data;
1135
1136         sk_offset = hbin_store_tdr(regf,
1137                                    (tdr_push_fn_t) tdr_push_sk_block,
1138                                    &new_sk);
1139         if (sk_offset == -1) {
1140                 DEBUG(0, ("Error storing sk block\n"));
1141                 return WERR_GENERAL_FAILURE;
1142         }
1143         private_data->nk->sk_offset = sk_offset;
1144
1145         if (update_cur_sk) {
1146                 hbin_store_tdr_resize(regf,
1147                                       (tdr_push_fn_t) tdr_push_sk_block,
1148                                       private_data->nk->sk_offset, &cur_sk);
1149         }
1150
1151         /* Get the previous security descriptor for the key */
1152         if (!hbin_get_tdr(regf, new_sk.prev_offset, regf,
1153                           (tdr_pull_fn_t) tdr_pull_sk_block, &sk)) {
1154                 DEBUG(0, ("Unable to find security descriptor for previous key\n"));
1155                 return WERR_BADFILE;
1156         }
1157         /* Change and store the previous security descriptor */
1158         sk.next_offset = sk_offset;
1159         hbin_store_tdr_resize(regf,
1160                               (tdr_push_fn_t) tdr_push_sk_block,
1161                               cur_sk.prev_offset, &sk);
1162
1163         /* Get the next security descriptor for the key (always root, as we append) */
1164         if (!hbin_get_tdr(regf, new_sk.next_offset, regf,
1165                           (tdr_pull_fn_t) tdr_pull_sk_block, &sk)) {
1166                 DEBUG(0, ("Unable to find security descriptor for current key\n"));
1167                 return WERR_BADFILE;
1168         }
1169         /* Change and store the next security descriptor (always root, as we append) */
1170         sk.prev_offset = sk_offset;
1171         hbin_store_tdr_resize(regf,
1172                               (tdr_push_fn_t) tdr_push_sk_block,
1173                               root.sk_offset, &sk);
1174
1175
1176         /* Store the nk. */
1177         hbin_store_tdr_resize(regf,
1178                               (tdr_push_fn_t) tdr_push_sk_block,
1179                               private_data->offset, private_data->nk);
1180         return WERR_OK;
1181 }
1182
1183 static WERROR regf_get_sec_desc(TALLOC_CTX *ctx, const struct hive_key *key,
1184                                 struct security_descriptor **sd)
1185 {
1186         const struct regf_key_data *private_data =
1187                 (const struct regf_key_data *)key;
1188         struct sk_block sk;
1189         struct regf_data *regf = private_data->hive;
1190         DATA_BLOB data;
1191
1192         if (!hbin_get_tdr(regf, private_data->nk->sk_offset, ctx,
1193                           (tdr_pull_fn_t) tdr_pull_sk_block, &sk)) {
1194                 DEBUG(0, ("Unable to find security descriptor\n"));
1195                 return WERR_GENERAL_FAILURE;
1196         }
1197
1198         if (strcmp(sk.header, "sk") != 0) {
1199                 DEBUG(0, ("Expected 'sk', got '%s'\n", sk.header));
1200                 return WERR_GENERAL_FAILURE;
1201         }
1202
1203         *sd = talloc(ctx, struct security_descriptor);
1204         W_ERROR_HAVE_NO_MEMORY(*sd);
1205
1206         data.data = sk.sec_desc;
1207         data.length = sk.rec_size;
1208         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_pull_struct_blob(&data, ctx, NULL, *sd,
1209                                                   (ndr_pull_flags_fn_t)ndr_pull_security_descriptor))) {
1210                 DEBUG(0, ("Error parsing security descriptor\n"));
1211                 return WERR_GENERAL_FAILURE;
1212         }
1213
1214         return WERR_OK;
1215 }
1216
1217 static WERROR regf_sl_add_entry(struct regf_data *regf, uint32_t list_offset,
1218                                 const char *name,
1219                                 uint32_t key_offset, uint32_t *ret)
1220 {
1221         DATA_BLOB data;
1222
1223         /* Create a new key if necessary */
1224         if (list_offset == -1) {
1225                 if (regf->header->version.major != 1) {
1226                         DEBUG(0, ("Can't store keys in unknown registry format\n"));
1227                         return WERR_NOT_SUPPORTED;
1228                 }
1229                 if (regf->header->version.minor < 3) {
1230                         /* Store LI */
1231                         struct li_block li;
1232                         ZERO_STRUCT(li);
1233                         li.header = "li";
1234                         li.key_count = 1;
1235
1236                         li.nk_offset = talloc_array(regf, uint32_t, 1);
1237                         W_ERROR_HAVE_NO_MEMORY(li.nk_offset);
1238                         li.nk_offset[0] = key_offset;
1239
1240                         *ret = hbin_store_tdr(regf,
1241                                               (tdr_push_fn_t) tdr_push_li_block,
1242                                               &li);
1243
1244                         talloc_free(li.nk_offset);
1245                 } else if (regf->header->version.minor == 3 ||
1246                            regf->header->version.minor == 4) {
1247                         /* Store LF */
1248                         struct lf_block lf;
1249                         ZERO_STRUCT(lf);
1250                         lf.header = "lf";
1251                         lf.key_count = 1;
1252
1253                         lf.hr = talloc_array(regf, struct hash_record, 1);
1254                         W_ERROR_HAVE_NO_MEMORY(lf.hr);
1255                         lf.hr[0].nk_offset = key_offset;
1256                         lf.hr[0].hash = talloc_strndup(lf.hr, name, 4);
1257                         W_ERROR_HAVE_NO_MEMORY(lf.hr[0].hash);
1258
1259                         *ret = hbin_store_tdr(regf,
1260                                               (tdr_push_fn_t) tdr_push_lf_block,
1261                                               &lf);
1262
1263                         talloc_free(lf.hr);
1264                 } else if (regf->header->version.minor == 5) {
1265                         /* Store LH */
1266                         struct lh_block lh;
1267                         ZERO_STRUCT(lh);
1268                         lh.header = "lh";
1269                         lh.key_count = 1;
1270
1271                         lh.hr = talloc_array(regf, struct lh_hash, 1);
1272                         W_ERROR_HAVE_NO_MEMORY(lh.hr);
1273                         lh.hr[0].nk_offset = key_offset;
1274                         lh.hr[0].base37 = regf_create_lh_hash(name);
1275
1276                         *ret = hbin_store_tdr(regf,
1277                                               (tdr_push_fn_t) tdr_push_lh_block,
1278                                               &lh);
1279
1280                         talloc_free(lh.hr);
1281                 }
1282                 return WERR_OK;
1283         }
1284
1285         data = hbin_get(regf, list_offset);
1286         if (!data.data) {
1287                 DEBUG(0, ("Unable to find subkey list\n"));
1288                 return WERR_BADFILE;
1289         }
1290
1291         if (!strncmp((char *)data.data, "li", 2)) {
1292                 struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
1293                 struct li_block li;
1294
1295                 pull->data = data;
1296
1297                 if (NT_STATUS_IS_ERR(tdr_pull_li_block(pull, regf, &li))) {
1298                         DEBUG(0, ("Error parsing LI list\n"));
1299                         talloc_free(pull);
1300                         return WERR_BADFILE;
1301                 }
1302                 talloc_free(pull);
1303
1304                 if (strncmp(li.header, "li", 2) != 0) {
1305                         abort();
1306                         DEBUG(0, ("LI header corrupt\n"));
1307                         return WERR_BADFILE;
1308                 }
1309
1310                 li.nk_offset = talloc_realloc(regf, li.nk_offset,
1311                                               uint32_t, li.key_count+1);
1312                 W_ERROR_HAVE_NO_MEMORY(li.nk_offset);
1313                 li.nk_offset[li.key_count] = key_offset;
1314                 li.key_count++;
1315                 *ret = hbin_store_tdr_resize(regf,
1316                                              (tdr_push_fn_t)tdr_push_li_block,
1317                                              list_offset, &li);
1318
1319                 talloc_free(li.nk_offset);
1320         } else if (!strncmp((char *)data.data, "lf", 2)) {
1321                 struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
1322                 struct lf_block lf;
1323
1324                 pull->data = data;
1325
1326                 if (NT_STATUS_IS_ERR(tdr_pull_lf_block(pull, regf, &lf))) {
1327                         DEBUG(0, ("Error parsing LF list\n"));
1328                         talloc_free(pull);
1329                         return WERR_BADFILE;
1330                 }
1331                 talloc_free(pull);
1332                 SMB_ASSERT(!strncmp(lf.header, "lf", 2));
1333
1334                 lf.hr = talloc_realloc(regf, lf.hr, struct hash_record,
1335                                        lf.key_count+1);
1336                 W_ERROR_HAVE_NO_MEMORY(lf.hr);
1337                 lf.hr[lf.key_count].nk_offset = key_offset;
1338                 lf.hr[lf.key_count].hash = talloc_strndup(lf.hr, name, 4);
1339                 W_ERROR_HAVE_NO_MEMORY(lf.hr[lf.key_count].hash);
1340                 lf.key_count++;
1341                 *ret = hbin_store_tdr_resize(regf,
1342                                              (tdr_push_fn_t)tdr_push_lf_block,
1343                                              list_offset, &lf);
1344
1345                 talloc_free(lf.hr);
1346         } else if (!strncmp((char *)data.data, "lh", 2)) {
1347                 struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
1348                 struct lh_block lh;
1349
1350                 pull->data = data;
1351
1352                 if (NT_STATUS_IS_ERR(tdr_pull_lh_block(pull, regf, &lh))) {
1353                         DEBUG(0, ("Error parsing LH list\n"));
1354                         talloc_free(pull);
1355                         return WERR_BADFILE;
1356                 }
1357                 talloc_free(pull);
1358                 SMB_ASSERT(!strncmp(lh.header, "lh", 2));
1359
1360                 lh.hr = talloc_realloc(regf, lh.hr, struct lh_hash,
1361                                        lh.key_count+1);
1362                 W_ERROR_HAVE_NO_MEMORY(lh.hr);
1363                 lh.hr[lh.key_count].nk_offset = key_offset;
1364                 lh.hr[lh.key_count].base37 = regf_create_lh_hash(name);
1365                 lh.key_count++;
1366                 *ret = hbin_store_tdr_resize(regf,
1367                                              (tdr_push_fn_t)tdr_push_lh_block,
1368                                              list_offset, &lh);
1369
1370                 talloc_free(lh.hr);
1371         } else if (!strncmp((char *)data.data, "ri", 2)) {
1372                 /* FIXME */
1373                 DEBUG(0, ("Adding to 'ri' subkey list is not supported yet.\n"));
1374                 return WERR_NOT_SUPPORTED;
1375         } else {
1376                 DEBUG(0, ("Cannot add to unknown subkey list\n"));
1377                 return WERR_BADFILE;
1378         }
1379
1380         return WERR_OK;
1381 }
1382
1383 static WERROR regf_sl_del_entry(struct regf_data *regf, uint32_t list_offset,
1384                                 uint32_t key_offset, uint32_t *ret)
1385 {
1386         DATA_BLOB data;
1387
1388         data = hbin_get(regf, list_offset);
1389         if (!data.data) {
1390                 DEBUG(0, ("Unable to find subkey list\n"));
1391                 return WERR_BADFILE;
1392         }
1393
1394         if (strncmp((char *)data.data, "li", 2) == 0) {
1395                 struct li_block li;
1396                 struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
1397                 uint16_t i;
1398                 bool found_offset = false;
1399
1400                 DEBUG(10, ("Subkeys in LI list\n"));
1401
1402                 pull->data = data;
1403
1404                 if (NT_STATUS_IS_ERR(tdr_pull_li_block(pull, regf, &li))) {
1405                         DEBUG(0, ("Error parsing LI list\n"));
1406                         talloc_free(pull);
1407                         return WERR_BADFILE;
1408                 }
1409                 talloc_free(pull);
1410
1411                 SMB_ASSERT(!strncmp(li.header, "li", 2));
1412
1413                 for (i = 0; i < li.key_count; i++) {
1414                         if (found_offset) {
1415                                 li.nk_offset[i-1] = li.nk_offset[i];
1416                         }
1417                         if (li.nk_offset[i] == key_offset) {
1418                                 found_offset = true;
1419                                 continue;
1420                         }
1421                 }
1422                 if (!found_offset) {
1423                         DEBUG(2, ("Subkey not found\n"));
1424                         return WERR_BADFILE;
1425                 }
1426                 li.key_count--;
1427
1428                 /* If the there are no entries left, free the subkey list */
1429                 if (li.key_count == 0) {
1430                         hbin_free(regf, list_offset);
1431                         *ret = -1;
1432                 }
1433
1434                 /* Store li block */
1435                 *ret = hbin_store_tdr_resize(regf,
1436                                              (tdr_push_fn_t) tdr_push_li_block,
1437                                              list_offset, &li);
1438         } else if (strncmp((char *)data.data, "lf", 2) == 0) {
1439                 struct lf_block lf;
1440                 struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
1441                 uint16_t i;
1442                 bool found_offset = false;
1443
1444                 DEBUG(10, ("Subkeys in LF list\n"));
1445
1446                 pull->data = data;
1447
1448                 if (NT_STATUS_IS_ERR(tdr_pull_lf_block(pull, regf, &lf))) {
1449                         DEBUG(0, ("Error parsing LF list\n"));
1450                         talloc_free(pull);
1451                         return WERR_BADFILE;
1452                 }
1453                 talloc_free(pull);
1454
1455                 SMB_ASSERT(!strncmp(lf.header, "lf", 2));
1456
1457                 for (i = 0; i < lf.key_count; i++) {
1458                         if (found_offset) {
1459                                 lf.hr[i-1] = lf.hr[i];
1460                                 continue;
1461                         }
1462                         if (lf.hr[i].nk_offset == key_offset) {
1463                                 found_offset = 1;
1464                                 continue;
1465                         }
1466                 }
1467                 if (!found_offset) {
1468                         DEBUG(2, ("Subkey not found\n"));
1469                         return WERR_BADFILE;
1470                 }
1471                 lf.key_count--;
1472
1473                 /* If the there are no entries left, free the subkey list */
1474                 if (lf.key_count == 0) {
1475                         hbin_free(regf, list_offset);
1476                         *ret = -1;
1477                         return WERR_OK;
1478                 }
1479
1480                 /* Store lf block */
1481                 *ret = hbin_store_tdr_resize(regf,
1482                                              (tdr_push_fn_t) tdr_push_lf_block,
1483                                              list_offset, &lf);
1484         } else if (strncmp((char *)data.data, "lh", 2) == 0) {
1485                 struct lh_block lh;
1486                 struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
1487                 uint16_t i;
1488                 bool found_offset = false;
1489
1490                 DEBUG(10, ("Subkeys in LH list\n"));
1491
1492                 pull->data = data;
1493
1494                 if (NT_STATUS_IS_ERR(tdr_pull_lh_block(pull, regf, &lh))) {
1495                         DEBUG(0, ("Error parsing LF list\n"));
1496                         talloc_free(pull);
1497                         return WERR_BADFILE;
1498                 }
1499                 talloc_free(pull);
1500
1501                 SMB_ASSERT(!strncmp(lh.header, "lh", 2));
1502
1503                 for (i = 0; i < lh.key_count; i++) {
1504                         if (found_offset) {
1505                                 lh.hr[i-1] = lh.hr[i];
1506                                 continue;
1507                         }
1508                         if (lh.hr[i].nk_offset == key_offset) {
1509                                 found_offset = 1;
1510                                 continue;
1511                         }
1512                 }
1513                 if (!found_offset) {
1514                         DEBUG(0, ("Subkey not found\n"));
1515                         return WERR_BADFILE;
1516                 }
1517                 lh.key_count--;
1518
1519                 /* If the there are no entries left, free the subkey list */
1520                 if (lh.key_count == 0) {
1521                         hbin_free(regf, list_offset);
1522                         *ret = -1;
1523                         return WERR_OK;
1524                 }
1525
1526                 /* Store lh block */
1527                 *ret = hbin_store_tdr_resize(regf,
1528                                              (tdr_push_fn_t) tdr_push_lh_block,
1529                                              list_offset, &lh);
1530         } else if (strncmp((char *)data.data, "ri", 2) == 0) {
1531                 /* FIXME */
1532                 DEBUG(0, ("Sorry, deletion from ri block is not supported yet.\n"));
1533                 return WERR_NOT_SUPPORTED;
1534         } else {
1535                 DEBUG (0, ("Unknown header found in subkey list.\n"));
1536                 return WERR_BADFILE;
1537         }
1538         return WERR_OK;
1539 }
1540
1541 static WERROR regf_del_value (struct hive_key *key, const char *name)
1542 {
1543         struct regf_key_data *private_data = (struct regf_key_data *)key;
1544         struct regf_data *regf = private_data->hive;
1545         struct nk_block *nk = private_data->nk;
1546         struct vk_block vk;
1547         uint32_t vk_offset;
1548         bool found_offset = false;
1549         DATA_BLOB values;
1550         uint32_t i;
1551
1552         if (nk->values_offset == -1) {
1553                 return WERR_BADFILE;
1554         }
1555
1556         values = hbin_get(regf, nk->values_offset);
1557
1558         for (i = 0; i < nk->num_values; i++) {
1559                 if (found_offset) {
1560                         ((uint32_t *)values.data)[i-1] = ((uint32_t *) values.data)[i];
1561                 } else {
1562                         vk_offset = IVAL(values.data, i * 4);
1563                         if (!hbin_get_tdr(regf, vk_offset, private_data,
1564                                           (tdr_pull_fn_t)tdr_pull_vk_block,
1565                                           &vk)) {
1566                                 DEBUG(0, ("Unable to get VK block at %d\n",
1567                                         vk_offset));
1568                                 return WERR_BADFILE;
1569                         }
1570                         if (strcmp(vk.data_name, name) == 0) {
1571                                 hbin_free(regf, vk_offset);
1572                                 found_offset = true;
1573                         }
1574                 }
1575         }
1576         if (!found_offset) {
1577                 return WERR_BADFILE;
1578         } else {
1579                 nk->num_values--;
1580                 values.length = (nk->num_values)*4;
1581         }
1582
1583         /* Store values list and nk */
1584         if (nk->num_values == 0) {
1585                 hbin_free(regf, nk->values_offset);
1586                 nk->values_offset = -1;
1587         } else {
1588                 nk->values_offset = hbin_store_resize(regf,
1589                                                       nk->values_offset,
1590                                                       values);
1591         }
1592         hbin_store_tdr_resize(regf, (tdr_push_fn_t) tdr_push_nk_block,
1593                               private_data->offset, nk);
1594
1595         return regf_save_hbin(private_data->hive);
1596 }
1597
1598
1599 static WERROR regf_del_key(const struct hive_key *parent, const char *name)
1600 {
1601         const struct regf_key_data *private_data =
1602                 (const struct regf_key_data *)parent;
1603         struct regf_key_data *key;
1604         struct nk_block *parent_nk;
1605         WERROR error;
1606
1607         SMB_ASSERT(private_data);
1608
1609         parent_nk = private_data->nk;
1610
1611         if (parent_nk->subkeys_offset == -1) {
1612                 DEBUG(4, ("Subkey list is empty, this key cannot contain subkeys.\n"));
1613                 return WERR_BADFILE;
1614         }
1615
1616         /* Find the key */
1617         if (!W_ERROR_IS_OK(regf_get_subkey_by_name(parent_nk, parent, name,
1618                                                    (struct hive_key **)&key))) {
1619                 DEBUG(2, ("Key '%s' not found\n", name));
1620                 return WERR_BADFILE;
1621         }
1622
1623         if (key->nk->subkeys_offset != -1) {
1624                 char *sk_name;
1625                 struct hive_key *sk = (struct hive_key *)key;
1626                 int i = key->nk->num_subkeys;
1627                 while (i--) {
1628                         /* Get subkey information. */
1629                         error = regf_get_subkey_by_index(parent_nk, sk, 0,
1630                                                          (const char **)&sk_name,
1631                                                          NULL, NULL);
1632                         if (!W_ERROR_IS_OK(error)) {
1633                                 DEBUG(0, ("Can't retrieve subkey by index.\n"));
1634                                 return error;
1635                         }
1636
1637                         /* Delete subkey. */
1638                         error = regf_del_key(sk, sk_name);
1639                         if (!W_ERROR_IS_OK(error)) {
1640                                 DEBUG(0, ("Can't delete key '%s'.\n", sk_name));
1641                                 return error;
1642                         }
1643
1644                         talloc_free(sk_name);
1645                 }
1646         }
1647
1648         if (key->nk->values_offset != -1) {
1649                 char *val_name;
1650                 struct hive_key *sk = (struct hive_key *)key;
1651                 DATA_BLOB data;
1652                 int i = key->nk->num_values;
1653                 while (i--) {
1654                         /* Get value information. */
1655                         error = regf_get_value(parent_nk, sk, 0,
1656                                                (const char **)&val_name,
1657                                                NULL, &data);
1658                         if (!W_ERROR_IS_OK(error)) {
1659                                 DEBUG(0, ("Can't retrieve value by index.\n"));
1660                                 return error;
1661                         }
1662
1663                         /* Delete value. */
1664                         error = regf_del_value(sk, val_name);
1665                         if (!W_ERROR_IS_OK(error)) {
1666                                 DEBUG(0, ("Can't delete value '%s'.\n", val_name));
1667                                 return error;
1668                         }
1669
1670                         talloc_free(val_name);
1671                 }
1672         }
1673
1674         /* Delete it from the subkey list. */
1675         error = regf_sl_del_entry(private_data->hive, parent_nk->subkeys_offset,
1676                                   key->offset, &parent_nk->subkeys_offset);
1677         if (!W_ERROR_IS_OK(error)) {
1678                 DEBUG(0, ("Can't store new subkey list for parent key. Won't delete.\n"));
1679                 return error;
1680         }
1681
1682         /* Re-store parent key */
1683         parent_nk->num_subkeys--;
1684         hbin_store_tdr_resize(private_data->hive,
1685                               (tdr_push_fn_t) tdr_push_nk_block,
1686                               private_data->offset, parent_nk);
1687
1688         if (key->nk->clsname_offset != -1) {
1689                 hbin_free(private_data->hive, key->nk->clsname_offset);
1690         }
1691         hbin_free(private_data->hive, key->offset);
1692
1693         return regf_save_hbin(private_data->hive);
1694 }
1695
1696 static WERROR regf_add_key(TALLOC_CTX *ctx, const struct hive_key *parent,
1697                            const char *name, const char *classname,
1698                            struct security_descriptor *sec_desc,
1699                            struct hive_key **ret)
1700 {
1701         const struct regf_key_data *private_data =
1702                 (const struct regf_key_data *)parent;
1703         struct nk_block *parent_nk = private_data->nk, nk;
1704         struct nk_block *root;
1705         struct regf_data *regf = private_data->hive;
1706         uint32_t offset;
1707         WERROR error;
1708
1709         nk.header = "nk";
1710         nk.type = REG_SUB_KEY;
1711         unix_to_nt_time(&nk.last_change, time(NULL));
1712         nk.uk1 = 0;
1713         nk.parent_offset = private_data->offset;
1714         nk.num_subkeys = 0;
1715         nk.uk2 = 0;
1716         nk.subkeys_offset = -1;
1717         nk.unknown_offset = -1;
1718         nk.num_values = 0;
1719         nk.values_offset = -1;
1720         memset(nk.unk3, 0, 5);
1721         nk.clsname_offset = -1; /* FIXME: fill in */
1722         nk.clsname_length = 0;
1723         nk.key_name = name;
1724
1725         /* Get the security descriptor of the root key */
1726         root = talloc_zero(ctx, struct nk_block);
1727         W_ERROR_HAVE_NO_MEMORY(root);
1728
1729         if (!hbin_get_tdr(regf, regf->header->data_offset, root,
1730                           (tdr_pull_fn_t)tdr_pull_nk_block, root)) {
1731                 DEBUG(0, ("Unable to find HBIN data for offset %d\n", offset));
1732                 return WERR_GENERAL_FAILURE;
1733         }
1734         nk.sk_offset = root->sk_offset;
1735         talloc_free(root);
1736
1737         /* Store the new nk key */
1738         offset = hbin_store_tdr(regf, (tdr_push_fn_t) tdr_push_nk_block, &nk);
1739
1740         error = regf_sl_add_entry(regf, parent_nk->subkeys_offset, name, offset,
1741                                   &parent_nk->subkeys_offset);
1742         if (!W_ERROR_IS_OK(error)) {
1743                 hbin_free(regf, offset);
1744                 return error;
1745         }
1746
1747         parent_nk->num_subkeys++;
1748
1749         /* Since the subkey offset of the parent can change, store it again */
1750         hbin_store_tdr_resize(regf, (tdr_push_fn_t) tdr_push_nk_block,
1751                                                   nk.parent_offset, parent_nk);
1752
1753         *ret = (struct hive_key *)regf_get_key(ctx, regf, offset);
1754
1755         return regf_save_hbin(private_data->hive);
1756 }
1757
1758 static WERROR regf_set_value(struct hive_key *key, const char *name,
1759                              uint32_t type, const DATA_BLOB data)
1760 {
1761         struct regf_key_data *private_data = (struct regf_key_data *)key;
1762         struct regf_data *regf = private_data->hive;
1763         struct nk_block *nk = private_data->nk;
1764         struct vk_block vk;
1765         uint32_t i;
1766         uint32_t tmp_vk_offset, vk_offset, old_vk_offset = -1;
1767         DATA_BLOB values;
1768
1769         ZERO_STRUCT(vk);
1770
1771         /* find the value offset, if it exists */
1772         if (nk->values_offset != -1) {
1773                 values = hbin_get(regf, nk->values_offset);
1774
1775                 for (i = 0; i < nk->num_values; i++) {
1776                         tmp_vk_offset = IVAL(values.data, i * 4);
1777                         if (!hbin_get_tdr(regf, tmp_vk_offset, private_data,
1778                                           (tdr_pull_fn_t)tdr_pull_vk_block,
1779                                           &vk)) {
1780                                 DEBUG(0, ("Unable to get VK block at %d\n",
1781                                         tmp_vk_offset));
1782                                 return WERR_GENERAL_FAILURE;
1783                         }
1784                         if (strcmp(vk.data_name, name) == 0) {
1785                                 old_vk_offset = tmp_vk_offset;
1786                                 break;
1787                         }
1788                 }
1789                 /* Free data, if any */
1790                 if (!(vk.data_length & 0x80000000)) {
1791                         hbin_free(regf, vk.data_offset);
1792                 }
1793         }
1794         if (old_vk_offset == -1) {
1795                 vk.header = "vk";
1796                 vk.name_length = strlen(name);
1797                 if (name != NULL && name[0] != 0) {
1798                         vk.flag = 1;
1799                         vk.data_name = name;
1800                 } else {
1801                         vk.data_name = NULL;
1802                         vk.flag = 0;
1803                 }
1804         }
1805         /* Set the type and data */
1806         vk.data_length = data.length;
1807         vk.data_type = type;
1808         if (type == REG_DWORD) {
1809                 vk.data_length |= 0x80000000;
1810                 vk.data_offset = *(uint32_t *)data.data;
1811         } else {
1812                 /* Store data somewhere */
1813                 vk.data_offset = hbin_store(regf, data);
1814         }
1815         if (old_vk_offset == -1) {
1816                 /* Store new vk */
1817                 vk_offset = hbin_store_tdr(regf,
1818                                            (tdr_push_fn_t) tdr_push_vk_block,
1819                                            &vk);
1820         } else {
1821                 /* Store vk at offset */
1822                 vk_offset = hbin_store_tdr_resize(regf,
1823                                                   (tdr_push_fn_t) tdr_push_vk_block,
1824                                                   old_vk_offset ,&vk);
1825         }
1826
1827         /* Re-allocate the value list */
1828         if (nk->values_offset == -1) {
1829                 nk->values_offset = hbin_store_tdr(regf,
1830                                                    (tdr_push_fn_t) tdr_push_uint32,
1831                                                    &vk_offset);
1832                 nk->num_values = 1;
1833         } else {
1834
1835                 /* Change if we're changing, otherwise we're adding the value */
1836                 if (old_vk_offset != -1) {
1837                         /* Find and overwrite the offset. */
1838                         for (i = 0; i < nk->num_values; i++) {
1839                                 if (IVAL(values.data, i * 4) == old_vk_offset) {
1840                                         SIVAL(values.data, i * 4, vk_offset);
1841                                         break;
1842                                 }
1843                         }
1844                 } else {
1845                         /* Create a new value list */
1846                         DATA_BLOB value_list;
1847
1848                         value_list.length = (nk->num_values+1)*4;
1849                         value_list.data = (uint8_t *)talloc_array(private_data,
1850                                                                   uint32_t,
1851                                                                   nk->num_values+1);
1852                         W_ERROR_HAVE_NO_MEMORY(value_list.data);
1853                         memcpy(value_list.data, values.data, nk->num_values * 4);
1854
1855                         SIVAL(value_list.data, nk->num_values * 4, vk_offset);
1856                         nk->num_values++;
1857                         nk->values_offset = hbin_store_resize(regf,
1858                                                               nk->values_offset,
1859                                                               value_list);
1860                 }
1861
1862         }
1863         hbin_store_tdr_resize(regf,
1864                               (tdr_push_fn_t) tdr_push_nk_block,
1865                               private_data->offset, nk);
1866         return regf_save_hbin(private_data->hive);
1867 }
1868
1869 static WERROR regf_save_hbin(struct regf_data *regf)
1870 {
1871         struct tdr_push *push = tdr_push_init(regf, regf->iconv_convenience);
1872         int i;
1873
1874         W_ERROR_HAVE_NO_MEMORY(push);
1875
1876         if (lseek(regf->fd, 0, SEEK_SET) == -1) {
1877                 DEBUG(0, ("Error lseeking in regf file\n"));
1878                 return WERR_GENERAL_FAILURE;
1879         }
1880
1881         /* Recompute checksum */
1882         if (NT_STATUS_IS_ERR(tdr_push_regf_hdr(push, regf->header))) {
1883                 DEBUG(0, ("Failed to push regf header\n"));
1884                 return WERR_GENERAL_FAILURE;
1885         }
1886         regf->header->chksum = regf_hdr_checksum(push->data.data);
1887         talloc_free(push);
1888
1889         if (NT_STATUS_IS_ERR(tdr_push_to_fd(regf->fd, regf->iconv_convenience,
1890                                             (tdr_push_fn_t)tdr_push_regf_hdr,
1891                                             regf->header))) {
1892                 DEBUG(0, ("Error writing registry file header\n"));
1893                 return WERR_GENERAL_FAILURE;
1894         }
1895
1896         if (lseek(regf->fd, 0x1000, SEEK_SET) == -1) {
1897                 DEBUG(0, ("Error lseeking to 0x1000 in regf file\n"));
1898                 return WERR_GENERAL_FAILURE;
1899         }
1900
1901         for (i = 0; regf->hbins[i]; i++) {
1902                 if (NT_STATUS_IS_ERR(tdr_push_to_fd(regf->fd, regf->iconv_convenience,
1903                                                     (tdr_push_fn_t)tdr_push_hbin_block,
1904                                                     regf->hbins[i]))) {
1905                         DEBUG(0, ("Error writing HBIN block\n"));
1906                         return WERR_GENERAL_FAILURE;
1907                 }
1908         }
1909
1910         return WERR_OK;
1911 }
1912
1913 WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx,
1914                             struct smb_iconv_convenience *iconv_convenience,
1915                             const char *location,
1916                             int minor_version, struct hive_key **key)
1917 {
1918         struct regf_data *regf;
1919         struct regf_hdr *regf_hdr;
1920         struct nk_block nk;
1921         struct sk_block sk;
1922         WERROR error;
1923         DATA_BLOB data;
1924         struct security_descriptor *sd;
1925         uint32_t sk_offset;
1926
1927         regf = (struct regf_data *)talloc_zero(NULL, struct regf_data);
1928
1929         regf->iconv_convenience = iconv_convenience;
1930
1931         W_ERROR_HAVE_NO_MEMORY(regf);
1932
1933         DEBUG(5, ("Attempting to create registry file\n"));
1934
1935         /* Get the header */
1936         regf->fd = creat(location, 0644);
1937
1938         if (regf->fd == -1) {
1939                 DEBUG(0,("Could not create file: %s, %s\n", location,
1940                                  strerror(errno)));
1941                 talloc_free(regf);
1942                 return WERR_GENERAL_FAILURE;
1943         }
1944
1945         regf_hdr = talloc_zero(regf, struct regf_hdr);
1946         W_ERROR_HAVE_NO_MEMORY(regf_hdr);
1947         regf_hdr->REGF_ID = "regf";
1948         unix_to_nt_time(&regf_hdr->modtime, time(NULL));
1949         regf_hdr->version.major = 1;
1950         regf_hdr->version.minor = minor_version;
1951         regf_hdr->last_block = 0x1000; /* Block size */
1952         regf_hdr->description = talloc_strdup(regf_hdr,
1953                                               "Registry created by Samba 4");
1954         W_ERROR_HAVE_NO_MEMORY(regf_hdr->description);
1955         regf_hdr->chksum = 0;
1956
1957         regf->header = regf_hdr;
1958
1959         /* Create all hbin blocks */
1960         regf->hbins = talloc_array(regf, struct hbin_block *, 1);
1961         W_ERROR_HAVE_NO_MEMORY(regf->hbins);
1962         regf->hbins[0] = NULL;
1963
1964         nk.header = "nk";
1965         nk.type = REG_SUB_KEY;
1966         unix_to_nt_time(&nk.last_change, time(NULL));
1967         nk.uk1 = 0;
1968         nk.parent_offset = -1;
1969         nk.num_subkeys = 0;
1970         nk.uk2 = 0;
1971         nk.subkeys_offset = -1;
1972         nk.unknown_offset = -1;
1973         nk.num_values = 0;
1974         nk.values_offset = -1;
1975         memset(nk.unk3, 0, 5);
1976         nk.clsname_offset = -1;
1977         nk.clsname_length = 0;
1978         nk.sk_offset = 0x80;
1979         nk.key_name = "SambaRootKey";
1980
1981         /*
1982          * It should be noted that changing the key_name to something shorter
1983          * creates a shorter nk block, which makes the position of the sk block
1984          * change. All Windows registries I've seen have the sk at 0x80.
1985          * I therefore recommend that our regf files share that offset -- Wilco
1986          */
1987
1988         /* Create a security descriptor. */
1989         sd = security_descriptor_dacl_create(regf,
1990                                          0,
1991                                          NULL, NULL,
1992                                          SID_NT_AUTHENTICATED_USERS,
1993                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1994                                          SEC_GENERIC_ALL,
1995                                          SEC_ACE_FLAG_OBJECT_INHERIT,
1996                                          NULL);
1997
1998         /* Push the security descriptor to a blob */
1999         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(&data, regf, NULL,
2000                                      sd, (ndr_push_flags_fn_t)ndr_push_security_descriptor))) {
2001                 DEBUG(0, ("Unable to push security descriptor\n"));
2002                 return WERR_GENERAL_FAILURE;
2003         }
2004
2005         ZERO_STRUCT(sk);
2006         sk.header = "sk";
2007         sk.prev_offset = 0x80;
2008         sk.next_offset = 0x80;
2009         sk.ref_cnt = 1;
2010         sk.rec_size = data.length;
2011         sk.sec_desc = data.data;
2012
2013         /* Store the new nk key */
2014         regf->header->data_offset = hbin_store_tdr(regf,
2015                                                    (tdr_push_fn_t)tdr_push_nk_block,
2016                                                    &nk);
2017         /* Store the sk block */
2018         sk_offset = hbin_store_tdr(regf,
2019                                    (tdr_push_fn_t) tdr_push_sk_block,
2020                                    &sk);
2021         if (sk_offset != 0x80) {
2022                 DEBUG(0, ("Error storing sk block, should be at 0x80, stored at 0x%x\n", nk.sk_offset));
2023                 return WERR_GENERAL_FAILURE;
2024         }
2025
2026
2027         *key = (struct hive_key *)regf_get_key(parent_ctx, regf,
2028                                                regf->header->data_offset);
2029
2030         error = regf_save_hbin(regf);
2031         if (!W_ERROR_IS_OK(error)) {
2032                 return error;
2033         }
2034
2035         /* We can drop our own reference now that *key will have created one */
2036         talloc_free(regf);
2037
2038         return WERR_OK;
2039 }
2040
2041 WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx, const char *location,
2042                           struct smb_iconv_convenience *iconv_convenience, struct hive_key **key)
2043 {
2044         struct regf_data *regf;
2045         struct regf_hdr *regf_hdr;
2046         struct tdr_pull *pull;
2047         int i;
2048
2049         regf = (struct regf_data *)talloc_zero(NULL, struct regf_data);
2050
2051         regf->iconv_convenience = iconv_convenience;
2052
2053         W_ERROR_HAVE_NO_MEMORY(regf);
2054
2055         DEBUG(5, ("Attempting to load registry file\n"));
2056
2057         /* Get the header */
2058         regf->fd = open(location, O_RDWR);
2059
2060         if (regf->fd == -1) {
2061                 DEBUG(0,("Could not load file: %s, %s\n", location,
2062                                  strerror(errno)));
2063                 talloc_free(regf);
2064                 return WERR_GENERAL_FAILURE;
2065         }
2066
2067         pull = tdr_pull_init(regf, regf->iconv_convenience);
2068
2069         pull->data.data = (uint8_t*)fd_load(regf->fd, &pull->data.length, 0, regf);
2070
2071         if (pull->data.data == NULL) {
2072                 DEBUG(0, ("Error reading data\n"));
2073                 talloc_free(regf);
2074                 return WERR_GENERAL_FAILURE;
2075         }
2076
2077         regf_hdr = talloc(regf, struct regf_hdr);
2078         W_ERROR_HAVE_NO_MEMORY(regf_hdr);
2079
2080         if (NT_STATUS_IS_ERR(tdr_pull_regf_hdr(pull, regf_hdr, regf_hdr))) {
2081                 talloc_free(regf);
2082                 return WERR_GENERAL_FAILURE;
2083         }
2084
2085         regf->header = regf_hdr;
2086
2087         if (strcmp(regf_hdr->REGF_ID, "regf") != 0) {
2088                 DEBUG(0, ("Unrecognized NT registry header id: %s, %s\n",
2089                         regf_hdr->REGF_ID, location));
2090                 talloc_free(regf);
2091                 return WERR_GENERAL_FAILURE;
2092         }
2093
2094         /* Validate the header ... */
2095         if (regf_hdr_checksum(pull->data.data) != regf_hdr->chksum) {
2096                 DEBUG(0, ("Registry file checksum error: %s: %d,%d\n",
2097                         location, regf_hdr->chksum,
2098                         regf_hdr_checksum(pull->data.data)));
2099                 talloc_free(regf);
2100                 return WERR_GENERAL_FAILURE;
2101         }
2102
2103         pull->offset = 0x1000;
2104
2105         i = 0;
2106         /* Read in all hbin blocks */
2107         regf->hbins = talloc_array(regf, struct hbin_block *, 1);
2108         W_ERROR_HAVE_NO_MEMORY(regf->hbins);
2109
2110         regf->hbins[0] = NULL;
2111
2112         while (pull->offset < pull->data.length &&
2113                pull->offset <= regf->header->last_block) {
2114                 struct hbin_block *hbin = talloc(regf->hbins,
2115                                                  struct hbin_block);
2116
2117                 W_ERROR_HAVE_NO_MEMORY(hbin);
2118
2119                 if (NT_STATUS_IS_ERR(tdr_pull_hbin_block(pull, hbin, hbin))) {
2120                         DEBUG(0, ("[%d] Error parsing HBIN block\n", i));
2121                         talloc_free(regf);
2122                         return WERR_FOOBAR;
2123                 }
2124
2125                 if (strcmp(hbin->HBIN_ID, "hbin") != 0) {
2126                         DEBUG(0, ("[%d] Expected 'hbin', got '%s'\n",
2127                                 i, hbin->HBIN_ID));
2128                         talloc_free(regf);
2129                         return WERR_FOOBAR;
2130                 }
2131
2132                 regf->hbins[i] = hbin;
2133                 i++;
2134                 regf->hbins = talloc_realloc(regf, regf->hbins,
2135                                              struct hbin_block *, i+2);
2136                 regf->hbins[i] = NULL;
2137         }
2138
2139         talloc_free(pull);
2140
2141         DEBUG(1, ("%d HBIN blocks read\n", i));
2142
2143         *key = (struct hive_key *)regf_get_key(parent_ctx, regf,
2144                                                regf->header->data_offset);
2145
2146         /* We can drop our own reference now that *key will have created one */
2147         talloc_free(regf);
2148
2149         return WERR_OK;
2150 }
2151
2152 static struct hive_operations reg_backend_regf = {
2153         .name = "regf",
2154         .get_key_info = regf_get_info,
2155         .enum_key = regf_get_subkey_by_index,
2156         .get_key_by_name = regf_get_subkey_by_name,
2157         .get_value_by_name = regf_get_value_by_name,
2158         .enum_value = regf_get_value,
2159         .get_sec_desc = regf_get_sec_desc,
2160         .set_sec_desc = regf_set_sec_desc,
2161         .add_key = regf_add_key,
2162         .set_value = regf_set_value,
2163         .del_key = regf_del_key,
2164         .delete_value = regf_del_value,
2165 };