?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Add vfs_linux_xfs_sgid
[Samba/ekacnet.git] / source3 / registry / regfio.c
blobd64eab84f9a72942b95d2fa3b0a745a61c8ab4bf
1 /*
2 * Unix SMB/CIFS implementation.
3 * Windows NT registry I/O library
4 * Copyright (c) Gerald (Jerry) Carter 2005
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "regfio.h"
22 #include "reg_objects.h"
23 #include "../librpc/gen_ndr/ndr_security.h"
24
25 #undef DBGC_CLASS
26 #define DBGC_CLASS DBGC_REGISTRY
27
28 /*******************************************************************
29 *
30 * TODO : Right now this code basically ignores classnames.
31 *
32 ******************************************************************/
33
34
35 /*******************************************************************
36 *******************************************************************/
37
38 static int write_block( REGF_FILE *file, prs_struct *ps, uint32 offset )
39 {
40 int bytes_written, returned;
41 char *buffer = prs_data_p( ps );
42 uint32 buffer_size = prs_data_size( ps );
43 SMB_STRUCT_STAT sbuf;
44
45 if ( file->fd == -1 )
46 return -1;
47
48 /* check for end of file */
49
50 if (sys_fstat(file->fd, &sbuf, false)) {
51 DEBUG(0,("write_block: stat() failed! (%s)\n", strerror(errno)));
52 return -1;
53 }
54
55 if ( lseek( file->fd, offset, SEEK_SET ) == -1 ) {
56 DEBUG(0,("write_block: lseek() failed! (%s)\n", strerror(errno) ));
57 return -1;
58 }
59
60 bytes_written = returned = 0;
61 while ( bytes_written < buffer_size ) {
62 if ( (returned = write( file->fd, buffer+bytes_written, buffer_size-bytes_written )) == -1 ) {
63 DEBUG(0,("write_block: write() failed! (%s)\n", strerror(errno) ));
64 return False;
65 }
66
67 bytes_written += returned;
68 }
69
70 return bytes_written;
71 }
72
73 /*******************************************************************
74 *******************************************************************/
75
76 static int read_block( REGF_FILE *file, prs_struct *ps, uint32 file_offset, uint32 block_size )
77 {
78 int bytes_read, returned;
79 char *buffer;
80 SMB_STRUCT_STAT sbuf;
81
82 /* check for end of file */
83
84 if (sys_fstat(file->fd, &sbuf, false)) {
85 DEBUG(0,("read_block: stat() failed! (%s)\n", strerror(errno)));
86 return -1;
87 }
88
89 if ( (size_t)file_offset >= sbuf.st_ex_size )
90 return -1;
91
92 /* if block_size == 0, we are parsing HBIN records and need
93 to read some of the header to get the block_size from there */
94
95 if ( block_size == 0 ) {
96 char hdr[0x20];
97
98 if ( lseek( file->fd, file_offset, SEEK_SET ) == -1 ) {
99 DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno) ));
100 return -1;
101 }
102
103 returned = read( file->fd, hdr, 0x20 );
104 if ( (returned == -1) || (returned < 0x20) ) {
105 DEBUG(0,("read_block: failed to read in HBIN header. Is the file corrupt?\n"));
106 return -1;
107 }
108
109 /* make sure this is an hbin header */
110
111 if ( strncmp( hdr, "hbin", HBIN_HDR_SIZE ) != 0 ) {
112 DEBUG(0,("read_block: invalid block header!\n"));
113 return -1;
114 }
115
116 block_size = IVAL( hdr, 0x08 );
117 }
118
119 DEBUG(10,("read_block: block_size == 0x%x\n", block_size ));
120
121 /* set the offset, initialize the buffer, and read the block from disk */
122
123 if ( lseek( file->fd, file_offset, SEEK_SET ) == -1 ) {
124 DEBUG(0,("read_block: lseek() failed! (%s)\n", strerror(errno) ));
125 return -1;
126 }
127
128 if (!prs_init( ps, block_size, file->mem_ctx, UNMARSHALL )) {
129 DEBUG(0,("read_block: prs_init() failed! (%s)\n", strerror(errno) ));
130 return -1;
131 }
132 buffer = prs_data_p( ps );
133 bytes_read = returned = 0;
134
135 while ( bytes_read < block_size ) {
136 if ( (returned = read( file->fd, buffer+bytes_read, block_size-bytes_read )) == -1 ) {
137 DEBUG(0,("read_block: read() failed (%s)\n", strerror(errno) ));
138 return False;
139 }
140 if ( (returned == 0) && (bytes_read < block_size) ) {
141 DEBUG(0,("read_block: not a vald registry file ?\n" ));
142 return False;
143 }
144
145 bytes_read += returned;
146 }
147
148 return bytes_read;
149 }
150
151 /*******************************************************************
152 *******************************************************************/
153
154 static bool write_hbin_block( REGF_FILE *file, REGF_HBIN *hbin )
155 {
156 if ( !hbin->dirty )
157 return True;
158
159 /* write free space record if any is available */
160
161 if ( hbin->free_off != REGF_OFFSET_NONE ) {
162 uint32 header = 0xffffffff;
163
164 if ( !prs_set_offset( &hbin->ps, hbin->free_off-sizeof(uint32) ) )
165 return False;
166 if ( !prs_uint32( "free_size", &hbin->ps, 0, &hbin->free_size ) )
167 return False;
168 if ( !prs_uint32( "free_header", &hbin->ps, 0, &header ) )
169 return False;
170 }
171
172 hbin->dirty = (write_block( file, &hbin->ps, hbin->file_off ) != -1);
173
174 return hbin->dirty;
175 }
176
177 /*******************************************************************
178 *******************************************************************/
179
180 static bool hbin_block_close( REGF_FILE *file, REGF_HBIN *hbin )
181 {
182 REGF_HBIN *p;
183
184 /* remove the block from the open list and flush it to disk */
185
186 for ( p=file->block_list; p && p!=hbin; p=p->next )
187 ;;
188
189 if ( p == hbin ) {
190 DLIST_REMOVE( file->block_list, hbin );
191 }
192 else
193 DEBUG(0,("hbin_block_close: block not in open list!\n"));
194
195 if ( !write_hbin_block( file, hbin ) )
196 return False;
197
198 return True;
199 }
200
201 /*******************************************************************
202 *******************************************************************/
203
204 static bool prs_regf_block( const char *desc, prs_struct *ps, int depth, REGF_FILE *file )
205 {
206 prs_debug(ps, depth, desc, "prs_regf_block");
207 depth++;
208
209 if ( !prs_uint8s( True, "header", ps, depth, (uint8*)file->header, sizeof( file->header )) )
210 return False;
211
212 /* yes, these values are always identical so store them only once */
213
214 if ( !prs_uint32( "unknown1", ps, depth, &file->unknown1 ))
215 return False;
216 if ( !prs_uint32( "unknown1 (again)", ps, depth, &file->unknown1 ))
217 return False;
218
219 /* get the modtime */
220
221 if ( !prs_set_offset( ps, 0x0c ) )
222 return False;
223 if ( !smb_io_time( "modtime", &file->mtime, ps, depth ) )
224 return False;
225
226 /* constants */
227
228 if ( !prs_uint32( "unknown2", ps, depth, &file->unknown2 ))
229 return False;
230 if ( !prs_uint32( "unknown3", ps, depth, &file->unknown3 ))
231 return False;
232 if ( !prs_uint32( "unknown4", ps, depth, &file->unknown4 ))
233 return False;
234 if ( !prs_uint32( "unknown5", ps, depth, &file->unknown5 ))
235 return False;
236
237 /* get file offsets */
238
239 if ( !prs_set_offset( ps, 0x24 ) )
240 return False;
241 if ( !prs_uint32( "data_offset", ps, depth, &file->data_offset ))
242 return False;
243 if ( !prs_uint32( "last_block", ps, depth, &file->last_block ))
244 return False;
245
246 /* one more constant */
247
248 if ( !prs_uint32( "unknown6", ps, depth, &file->unknown6 ))
249 return False;
250
251 /* get the checksum */
252
253 if ( !prs_set_offset( ps, 0x01fc ) )
254 return False;
255 if ( !prs_uint32( "checksum", ps, depth, &file->checksum ))
256 return False;
257
258 return True;
259 }
260
261 /*******************************************************************
262 *******************************************************************/
263
264 static bool prs_hbin_block( const char *desc, prs_struct *ps, int depth, REGF_HBIN *hbin )
265 {
266 uint32 block_size2;
267
268 prs_debug(ps, depth, desc, "prs_regf_block");
269 depth++;
270
271 if ( !prs_uint8s( True, "header", ps, depth, (uint8*)hbin->header, sizeof( hbin->header )) )
272 return False;
273
274 if ( !prs_uint32( "first_hbin_off", ps, depth, &hbin->first_hbin_off ))
275 return False;
276
277 /* The dosreg.cpp comments say that the block size is at 0x1c.
278 According to a WINXP NTUSER.dat file, this is wrong. The block_size
279 is at 0x08 */
280
281 if ( !prs_uint32( "block_size", ps, depth, &hbin->block_size ))
282 return False;
283
284 block_size2 = hbin->block_size;
285 prs_set_offset( ps, 0x1c );
286 if ( !prs_uint32( "block_size2", ps, depth, &block_size2 ))
287 return False;
288
289 if ( MARSHALLING(ps) )
290 hbin->dirty = True;
291
292
293 return True;
294 }
295
296 /*******************************************************************
297 *******************************************************************/
298
299 static bool prs_nk_rec( const char *desc, prs_struct *ps, int depth, REGF_NK_REC *nk )
300 {
301 uint16 class_length, name_length;
302 uint32 start;
303 uint32 data_size, start_off, end_off;
304 uint32 unknown_off = REGF_OFFSET_NONE;
305
306 nk->hbin_off = prs_offset( ps );
307 start = nk->hbin_off;
308
309 prs_debug(ps, depth, desc, "prs_nk_rec");
310 depth++;
311
312 /* back up and get the data_size */
313
314 if ( !prs_set_offset( ps, prs_offset(ps)-sizeof(uint32)) )
315 return False;
316 start_off = prs_offset( ps );
317 if ( !prs_uint32( "rec_size", ps, depth, &nk->rec_size ))
318 return False;
319
320 if ( !prs_uint8s( True, "header", ps, depth, (uint8*)nk->header, sizeof( nk->header )) )
321 return False;
322
323 if ( !prs_uint16( "key_type", ps, depth, &nk->key_type ))
324 return False;
325 if ( !smb_io_time( "mtime", &nk->mtime, ps, depth ))
326 return False;
327
328 if ( !prs_set_offset( ps, start+0x0010 ) )
329 return False;
330 if ( !prs_uint32( "parent_off", ps, depth, &nk->parent_off ))
331 return False;
332 if ( !prs_uint32( "num_subkeys", ps, depth, &nk->num_subkeys ))
333 return False;
334
335 if ( !prs_set_offset( ps, start+0x001c ) )
336 return False;
337 if ( !prs_uint32( "subkeys_off", ps, depth, &nk->subkeys_off ))
338 return False;
339 if ( !prs_uint32( "unknown_off", ps, depth, &unknown_off) )
340 return False;
341
342 if ( !prs_set_offset( ps, start+0x0024 ) )
343 return False;
344 if ( !prs_uint32( "num_values", ps, depth, &nk->num_values ))
345 return False;
346 if ( !prs_uint32( "values_off", ps, depth, &nk->values_off ))
347 return False;
348 if ( !prs_uint32( "sk_off", ps, depth, &nk->sk_off ))
349 return False;
350 if ( !prs_uint32( "classname_off", ps, depth, &nk->classname_off ))
351 return False;
352
353 if ( !prs_uint32( "max_bytes_subkeyname", ps, depth, &nk->max_bytes_subkeyname))
354 return False;
355 if ( !prs_uint32( "max_bytes_subkeyclassname", ps, depth, &nk->max_bytes_subkeyclassname))
356 return False;
357 if ( !prs_uint32( "max_bytes_valuename", ps, depth, &nk->max_bytes_valuename))
358 return False;
359 if ( !prs_uint32( "max_bytes_value", ps, depth, &nk->max_bytes_value))
360 return False;
361 if ( !prs_uint32( "unknown index", ps, depth, &nk->unk_index))
362 return False;
363
364 name_length = nk->keyname ? strlen(nk->keyname) : 0 ;
365 class_length = nk->classname ? strlen(nk->classname) : 0 ;
366 if ( !prs_uint16( "name_length", ps, depth, &name_length ))
367 return False;
368 if ( !prs_uint16( "class_length", ps, depth, &class_length ))
369 return False;
370
371 if ( class_length ) {
372 ;;
373 }
374
375 if ( name_length ) {
376 if ( UNMARSHALLING(ps) ) {
377 if ( !(nk->keyname = PRS_ALLOC_MEM( ps, char, name_length+1 )) )
378 return False;
379 }
380
381 if ( !prs_uint8s( True, "name", ps, depth, (uint8*)nk->keyname, name_length) )
382 return False;
383
384 if ( UNMARSHALLING(ps) )
385 nk->keyname[name_length] = '\0';
386 }
387
388 end_off = prs_offset( ps );
389
390 /* data_size must be divisible by 8 and large enough to hold the original record */
391
392 data_size = ((start_off - end_off) & 0xfffffff8 );
393 if ( data_size > nk->rec_size )
394 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, nk->rec_size));
395
396 if ( MARSHALLING(ps) )
397 nk->hbin->dirty = True;
398
399 return True;
400 }
401
402 /*******************************************************************
403 *******************************************************************/
404
405 static uint32 regf_block_checksum( prs_struct *ps )
406 {
407 char *buffer = prs_data_p( ps );
408 uint32 checksum, x;
409 int i;
410
411 /* XOR of all bytes 0x0000 - 0x01FB */
412
413 checksum = x = 0;
414
415 for ( i=0; i<0x01FB; i+=4 ) {
416 x = IVAL(buffer, i );
417 checksum ^= x;
418 }
419
420 return checksum;
421 }
422
423 /*******************************************************************
424 *******************************************************************/
425
426 static bool read_regf_block( REGF_FILE *file )
427 {
428 prs_struct ps;
429 uint32 checksum;
430
431 /* grab the first block from the file */
432
433 if ( read_block( file, &ps, 0, REGF_BLOCKSIZE ) == -1 )
434 return False;
435
436 /* parse the block and verify the checksum */
437
438 if ( !prs_regf_block( "regf_header", &ps, 0, file ) )
439 return False;
440
441 checksum = regf_block_checksum( &ps );
442
443 prs_mem_free( &ps );
444
445 if ( file->checksum != checksum ) {
446 DEBUG(0,("read_regf_block: invalid checksum\n" ));
447 return False;
448 }
449
450 return True;
451 }
452
453 /*******************************************************************
454 *******************************************************************/
455
456 static REGF_HBIN* read_hbin_block( REGF_FILE *file, off_t offset )
457 {
458 REGF_HBIN *hbin;
459 uint32 record_size, curr_off, block_size, header;
460
461 if ( !(hbin = TALLOC_ZERO_P(file->mem_ctx, REGF_HBIN)) )
462 return NULL;
463 hbin->file_off = offset;
464 hbin->free_off = -1;
465
466 if ( read_block( file, &hbin->ps, offset, 0 ) == -1 )
467 return NULL;
468
469 if ( !prs_hbin_block( "hbin", &hbin->ps, 0, hbin ) )
470 return NULL;
471
472 /* this should be the same thing as hbin->block_size but just in case */
473
474 block_size = prs_data_size( &hbin->ps );
475
476 /* Find the available free space offset. Always at the end,
477 so walk the record list and stop when you get to the end.
478 The end is defined by a record header of 0xffffffff. The
479 previous 4 bytes contains the amount of free space remaining
480 in the hbin block. */
481
482 /* remember that the record_size is in the 4 bytes preceeding the record itself */
483
484 if ( !prs_set_offset( &hbin->ps, file->data_offset+HBIN_HDR_SIZE-sizeof(uint32) ) )
485 return False;
486
487 record_size = 0;
488 header = 0;
489 curr_off = prs_offset( &hbin->ps );
490 while ( header != 0xffffffff ) {
491 /* not done yet so reset the current offset to the
492 next record_size field */
493
494 curr_off = curr_off+record_size;
495
496 /* for some reason the record_size of the last record in
497 an hbin block can extend past the end of the block
498 even though the record fits within the remaining
499 space....aaarrrgggghhhhhh */
500
501 if ( curr_off >= block_size ) {
502 record_size = -1;
503 curr_off = -1;
504 break;
505 }
506
507 if ( !prs_set_offset( &hbin->ps, curr_off) )
508 return False;
509
510 if ( !prs_uint32( "rec_size", &hbin->ps, 0, &record_size ) )
511 return False;
512 if ( !prs_uint32( "header", &hbin->ps, 0, &header ) )
513 return False;
514
515 SMB_ASSERT( record_size != 0 );
516
517 if ( record_size & 0x80000000 ) {
518 /* absolute_value(record_size) */
519 record_size = (record_size ^ 0xffffffff) + 1;
520 }
521 }
522
523 /* save the free space offset */
524
525 if ( header == 0xffffffff ) {
526
527 /* account for the fact that the curr_off is 4 bytes behind the actual
528 record header */
529
530 hbin->free_off = curr_off + sizeof(uint32);
531 hbin->free_size = record_size;
532 }
533
534 DEBUG(10,("read_hbin_block: free space offset == 0x%x\n", hbin->free_off));
535
536 if ( !prs_set_offset( &hbin->ps, file->data_offset+HBIN_HDR_SIZE ) )
537 return False;
538
539 return hbin;
540 }
541
542 /*******************************************************************
543 Input a random offset and receive the corresponding HBIN
544 block for it
545 *******************************************************************/
546
547 static bool hbin_contains_offset( REGF_HBIN *hbin, uint32 offset )
548 {
549 if ( !hbin )
550 return False;
551
552 if ( (offset > hbin->first_hbin_off) && (offset < (hbin->first_hbin_off+hbin->block_size)) )
553 return True;
554
555 return False;
556 }
557
558 /*******************************************************************
559 Input a random offset and receive the corresponding HBIN
560 block for it
561 *******************************************************************/
562
563 static REGF_HBIN* lookup_hbin_block( REGF_FILE *file, uint32 offset )
564 {
565 REGF_HBIN *hbin = NULL;
566 uint32 block_off;
567
568 /* start with the open list */
569
570 for ( hbin=file->block_list; hbin; hbin=hbin->next ) {
571 DEBUG(10,("lookup_hbin_block: address = 0x%x [0x%lx]\n", hbin->file_off, (unsigned long)hbin ));
572 if ( hbin_contains_offset( hbin, offset ) )
573 return hbin;
574 }
575
576 if ( !hbin ) {
577 /* start at the beginning */
578
579 block_off = REGF_BLOCKSIZE;
580 do {
581 /* cleanup before the next round */
582 if ( hbin )
583 prs_mem_free( &hbin->ps );
584
585 hbin = read_hbin_block( file, block_off );
586
587 if ( hbin )
588 block_off = hbin->file_off + hbin->block_size;
589
590 } while ( hbin && !hbin_contains_offset( hbin, offset ) );
591 }
592
593 if ( hbin )
594 DLIST_ADD( file->block_list, hbin );
595
596 return hbin;
597 }
598
599 /*******************************************************************
600 *******************************************************************/
601
602 static bool prs_hash_rec( const char *desc, prs_struct *ps, int depth, REGF_HASH_REC *hash )
603 {
604 prs_debug(ps, depth, desc, "prs_hash_rec");
605 depth++;
606
607 if ( !prs_uint32( "nk_off", ps, depth, &hash->nk_off ))
608 return False;
609 if ( !prs_uint8s( True, "keycheck", ps, depth, hash->keycheck, sizeof( hash->keycheck )) )
610 return False;
611
612 return True;
613 }
614
615 /*******************************************************************
616 *******************************************************************/
617
618 static bool hbin_prs_lf_records( const char *desc, REGF_HBIN *hbin, int depth, REGF_NK_REC *nk )
619 {
620 int i;
621 REGF_LF_REC *lf = &nk->subkeys;
622 uint32 data_size, start_off, end_off;
623
624 prs_debug(&hbin->ps, depth, desc, "prs_lf_records");
625 depth++;
626
627 /* check if we have anything to do first */
628
629 if ( nk->num_subkeys == 0 )
630 return True;
631
632 /* move to the LF record */
633
634 if ( !prs_set_offset( &hbin->ps, nk->subkeys_off + HBIN_HDR_SIZE - hbin->first_hbin_off ) )
635 return False;
636
637 /* backup and get the data_size */
638
639 if ( !prs_set_offset( &hbin->ps, prs_offset(&hbin->ps)-sizeof(uint32)) )
640 return False;
641 start_off = prs_offset( &hbin->ps );
642 if ( !prs_uint32( "rec_size", &hbin->ps, depth, &lf->rec_size ))
643 return False;
644
645 if ( !prs_uint8s( True, "header", &hbin->ps, depth, (uint8*)lf->header, sizeof( lf->header )) )
646 return False;
647
648 if ( !prs_uint16( "num_keys", &hbin->ps, depth, &lf->num_keys))
649 return False;
650
651 if ( UNMARSHALLING(&hbin->ps) ) {
652 if (lf->num_keys) {
653 if ( !(lf->hashes = PRS_ALLOC_MEM( &hbin->ps, REGF_HASH_REC, lf->num_keys )) )
654 return False;
655 } else {
656 lf->hashes = NULL;
657 }
658 }
659
660 for ( i=0; i<lf->num_keys; i++ ) {
661 if ( !prs_hash_rec( "hash_rec", &hbin->ps, depth, &lf->hashes[i] ) )
662 return False;
663 }
664
665 end_off = prs_offset( &hbin->ps );
666
667 /* data_size must be divisible by 8 and large enough to hold the original record */
668
669 data_size = ((start_off - end_off) & 0xfffffff8 );
670 if ( data_size > lf->rec_size )
671 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, lf->rec_size));
672
673 if ( MARSHALLING(&hbin->ps) )
674 hbin->dirty = True;
675
676 return True;
677 }
678
679 /*******************************************************************
680 *******************************************************************/
681
682 static bool hbin_prs_sk_rec( const char *desc, REGF_HBIN *hbin, int depth, REGF_SK_REC *sk )
683 {
684 prs_struct *ps = &hbin->ps;
685 uint16 tag = 0xFFFF;
686 uint32 data_size, start_off, end_off;
687
688
689 prs_debug(ps, depth, desc, "hbin_prs_sk_rec");
690 depth++;
691
692 if ( !prs_set_offset( &hbin->ps, sk->sk_off + HBIN_HDR_SIZE - hbin->first_hbin_off ) )
693 return False;
694
695 /* backup and get the data_size */
696
697 if ( !prs_set_offset( &hbin->ps, prs_offset(&hbin->ps)-sizeof(uint32)) )
698 return False;
699 start_off = prs_offset( &hbin->ps );
700 if ( !prs_uint32( "rec_size", &hbin->ps, depth, &sk->rec_size ))
701 return False;
702
703 if ( !prs_uint8s( True, "header", ps, depth, (uint8*)sk->header, sizeof( sk->header )) )
704 return False;
705 if ( !prs_uint16( "tag", ps, depth, &tag))
706 return False;
707
708 if ( !prs_uint32( "prev_sk_off", ps, depth, &sk->prev_sk_off))
709 return False;
710 if ( !prs_uint32( "next_sk_off", ps, depth, &sk->next_sk_off))
711 return False;
712 if ( !prs_uint32( "ref_count", ps, depth, &sk->ref_count))
713 return False;
714 if ( !prs_uint32( "size", ps, depth, &sk->size))
715 return False;
716
717 {
718 NTSTATUS status;
719 TALLOC_CTX *mem_ctx = prs_get_mem_context(&hbin->ps);
720 DATA_BLOB blob;
721
722 if (MARSHALLING(&hbin->ps)) {
723 status = marshall_sec_desc(mem_ctx,
724 sk->sec_desc,
725 &blob.data, &blob.length);
726 if (!NT_STATUS_IS_OK(status))
727 return False;
728 if (!prs_copy_data_in(&hbin->ps, (const char *)blob.data, blob.length))
729 return False;
730 } else {
731 blob = data_blob_const(prs_data_p(&hbin->ps),
732 prs_data_size(&hbin->ps));
733 status = unmarshall_sec_desc(mem_ctx,
734 blob.data, blob.length,
735 &sk->sec_desc);
736 if (!NT_STATUS_IS_OK(status))
737 return False;
738 prs_set_offset(&hbin->ps, blob.length);
739 }
740 }
741
742 end_off = prs_offset( &hbin->ps );
743
744 /* data_size must be divisible by 8 and large enough to hold the original record */
745
746 data_size = ((start_off - end_off) & 0xfffffff8 );
747 if ( data_size > sk->rec_size )
748 DEBUG(10,("Encountered reused record (0x%x < 0x%x)\n", data_size, sk->rec_size));
749
750 if ( MARSHALLING(&hbin->ps) )
751 hbin->dirty = True;
752
753 return True;
754 }
755
756 /*******************************************************************
757 *******************************************************************/
758
759 static bool hbin_prs_vk_rec( const char *desc, REGF_HBIN *hbin, int depth, REGF_VK_REC *vk, REGF_FILE *file )
760 {
761 uint32 offset;
762 uint16 name_length;
763 prs_struct *ps = &hbin->ps;
764 uint32 data_size, start_off, end_off;
765
766 prs_debug(ps, depth, desc, "prs_vk_rec");
767 depth++;
768
769 /* backup and get the data_size */
770
771 if ( !prs_set_offset( &hbin->ps, prs_offset(&hbin->ps)-sizeof(uint32)) )
772 return False;
773 start_off = prs_offset( &hbin->ps );
774 if ( !prs_uint32( "rec_size", &hbin->ps, depth, &vk->rec_size ))
775 return False;
776
777 if ( !prs_uint8s( True, "header", ps, depth, (uint8*)vk->header, sizeof( vk->header )) )
778 return False;
779
780 if ( MARSHALLING(&hbin->ps) )
781 name_length = strlen(vk->valuename);
782
783 if ( !prs_uint16( "name_length", ps, depth, &name_length ))
784 return False;
785 if ( !prs_uint32( "data_size", ps, depth, &vk->data_size ))
786 return False;
787 if ( !prs_uint32( "data_off", ps, depth, &vk->data_off ))
788 return False;
789 if ( !prs_uint32( "type", ps, depth, &vk->type))
790 return False;
791 if ( !prs_uint16( "flag", ps, depth, &vk->flag))
792 return False;
793
794 offset = prs_offset( ps );
795 offset += 2; /* skip 2 bytes */
796 prs_set_offset( ps, offset );
797
798 /* get the name */
799
800 if ( vk->flag&VK_FLAG_NAME_PRESENT ) {
801
802 if ( UNMARSHALLING(&hbin->ps) ) {
803 if ( !(vk->valuename = PRS_ALLOC_MEM( ps, char, name_length+1 )))
804 return False;
805 }
806 if ( !prs_uint8s( True, "name", ps, depth, (uint8*)vk->valuename, name_length ) )
807 return False;
808 }
809
810 end_off = prs_offset( &hbin->ps );
811
812 /* get the data if necessary */
813
814 if ( vk->data_size != 0 ) {
815 bool charmode = False;
816
817 if ( (vk->type == REG_SZ) || (vk->type == REG_MULTI_SZ) )
818 charmode = True;
819
820 /* the data is stored in the offset if the size <= 4 */
821
822 if ( !(vk->data_size & VK_DATA_IN_OFFSET) ) {
823 REGF_HBIN *hblock = hbin;
824 uint32 data_rec_size;
825
826 if ( UNMARSHALLING(&hbin->ps) ) {
827 if ( !(vk->data = PRS_ALLOC_MEM( ps, uint8, vk->data_size) ) )
828 return False;
829 }
830
831 /* this data can be in another hbin */
832 if ( !hbin_contains_offset( hbin, vk->data_off ) ) {
833 if ( !(hblock = lookup_hbin_block( file, vk->data_off )) )
834 return False;
835 }
836 if ( !(prs_set_offset( &hblock->ps, (vk->data_off+HBIN_HDR_SIZE-hblock->first_hbin_off)-sizeof(uint32) )) )
837 return False;
838
839 if ( MARSHALLING(&hblock->ps) ) {
840 data_rec_size = ( (vk->data_size+sizeof(uint32)) & 0xfffffff8 ) + 8;
841 data_rec_size = ( data_rec_size - 1 ) ^ 0xFFFFFFFF;
842 }
843 if ( !prs_uint32( "data_rec_size", &hblock->ps, depth, &data_rec_size ))
844 return False;
845 if ( !prs_uint8s( charmode, "data", &hblock->ps, depth, vk->data, vk->data_size) )
846 return False;
847
848 if ( MARSHALLING(&hblock->ps) )
849 hblock->dirty = True;
850 }
851 else {
852 if ( !(vk->data = PRS_ALLOC_MEM( ps, uint8, 4 ) ) )
853 return False;
854 SIVAL( vk->data, 0, vk->data_off );
855 }
856
857 }
858
859 /* data_size must be divisible by 8 and large enough to hold the original record */
860
861 data_size = ((start_off - end_off ) & 0xfffffff8 );
862 if ( data_size != vk->rec_size )
863 DEBUG(10,("prs_vk_rec: data_size check failed (0x%x < 0x%x)\n", data_size, vk->rec_size));
864
865 if ( MARSHALLING(&hbin->ps) )
866 hbin->dirty = True;
867
868 return True;
869 }
870
871 /*******************************************************************
872 read a VK record which is contained in the HBIN block stored
873 in the prs_struct *ps.
874 *******************************************************************/
875
876 static bool hbin_prs_vk_records( const char *desc, REGF_HBIN *hbin, int depth, REGF_NK_REC *nk, REGF_FILE *file )
877 {
878 int i;
879 uint32 record_size;
880
881 prs_debug(&hbin->ps, depth, desc, "prs_vk_records");
882 depth++;
883
884 /* check if we have anything to do first */
885
886 if ( nk->num_values == 0 )
887 return True;
888
889 if ( UNMARSHALLING(&hbin->ps) ) {
890 if ( !(nk->values = PRS_ALLOC_MEM( &hbin->ps, REGF_VK_REC, nk->num_values ) ) )
891 return False;
892 }
893
894 /* convert the offset to something relative to this HBIN block */
895
896 if ( !prs_set_offset( &hbin->ps, nk->values_off+HBIN_HDR_SIZE-hbin->first_hbin_off-sizeof(uint32)) )
897 return False;
898
899 if ( MARSHALLING( &hbin->ps) ) {
900 record_size = ( ( nk->num_values * sizeof(uint32) ) & 0xfffffff8 ) + 8;
901 record_size = (record_size - 1) ^ 0xFFFFFFFF;
902 }
903
904 if ( !prs_uint32( "record_size", &hbin->ps, depth, &record_size ) )
905 return False;
906
907 for ( i=0; i<nk->num_values; i++ ) {
908 if ( !prs_uint32( "vk_off", &hbin->ps, depth, &nk->values[i].rec_off ) )
909 return False;
910 }
911
912 for ( i=0; i<nk->num_values; i++ ) {
913 REGF_HBIN *sub_hbin = hbin;
914 uint32 new_offset;
915
916 if ( !hbin_contains_offset( hbin, nk->values[i].rec_off ) ) {
917 sub_hbin = lookup_hbin_block( file, nk->values[i].rec_off );
918 if ( !sub_hbin ) {
919 DEBUG(0,("hbin_prs_vk_records: Failed to find HBIN block containing offset [0x%x]\n",
920 nk->values[i].hbin_off));
921 return False;
922 }
923 }
924
925 new_offset = nk->values[i].rec_off + HBIN_HDR_SIZE - sub_hbin->first_hbin_off;
926 if ( !prs_set_offset( &sub_hbin->ps, new_offset ) )
927 return False;
928 if ( !hbin_prs_vk_rec( "vk_rec", sub_hbin, depth, &nk->values[i], file ) )
929 return False;
930 }
931
932 if ( MARSHALLING(&hbin->ps) )
933 hbin->dirty = True;
934
935
936 return True;
937 }
938
939
940 /*******************************************************************
941 *******************************************************************/
942
943 static REGF_SK_REC* find_sk_record_by_offset( REGF_FILE *file, uint32 offset )
944 {
945 REGF_SK_REC *p_sk;
946
947 for ( p_sk=file->sec_desc_list; p_sk; p_sk=p_sk->next ) {
948 if ( p_sk->sk_off == offset )
949 return p_sk;
950 }
951
952 return NULL;
953 }
954
955 /*******************************************************************
956 *******************************************************************/
957
958 static REGF_SK_REC* find_sk_record_by_sec_desc( REGF_FILE *file, struct security_descriptor *sd )
959 {
960 REGF_SK_REC *p;
961
962 for ( p=file->sec_desc_list; p; p=p->next ) {
963 if ( security_descriptor_equal( p->sec_desc, sd ) )
964 return p;
965 }
966
967 /* failure */
968
969 return NULL;
970 }
971
972 /*******************************************************************
973 *******************************************************************/
974
975 static bool hbin_prs_key( REGF_FILE *file, REGF_HBIN *hbin, REGF_NK_REC *nk )
976 {
977 int depth = 0;
978 REGF_HBIN *sub_hbin;
979
980 prs_debug(&hbin->ps, depth, "", "fetch_key");
981 depth++;
982
983 /* get the initial nk record */
984
985 if ( !prs_nk_rec( "nk_rec", &hbin->ps, depth, nk ))
986 return False;
987
988 /* fill in values */
989
990 if ( nk->num_values && (nk->values_off!=REGF_OFFSET_NONE) ) {
991 sub_hbin = hbin;
992 if ( !hbin_contains_offset( hbin, nk->values_off ) ) {
993 sub_hbin = lookup_hbin_block( file, nk->values_off );
994 if ( !sub_hbin ) {
995 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing value_list_offset [0x%x]\n",
996 nk->values_off));
997 return False;
998 }
999 }
1000
1001 if ( !hbin_prs_vk_records( "vk_rec", sub_hbin, depth, nk, file ))
1002 return False;
1003 }
1004
1005 /* now get subkeys */
1006
1007 if ( nk->num_subkeys && (nk->subkeys_off!=REGF_OFFSET_NONE) ) {
1008 sub_hbin = hbin;
1009 if ( !hbin_contains_offset( hbin, nk->subkeys_off ) ) {
1010 sub_hbin = lookup_hbin_block( file, nk->subkeys_off );
1011 if ( !sub_hbin ) {
1012 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing subkey_offset [0x%x]\n",
1013 nk->subkeys_off));
1014 return False;
1015 }
1016 }
1017
1018 if ( !hbin_prs_lf_records( "lf_rec", sub_hbin, depth, nk ))
1019 return False;
1020 }
1021
1022 /* get the to the security descriptor. First look if we have already parsed it */
1023
1024 if ( (nk->sk_off!=REGF_OFFSET_NONE) && !( nk->sec_desc = find_sk_record_by_offset( file, nk->sk_off )) ) {
1025
1026 sub_hbin = hbin;
1027 if ( !hbin_contains_offset( hbin, nk->sk_off ) ) {
1028 sub_hbin = lookup_hbin_block( file, nk->sk_off );
1029 if ( !sub_hbin ) {
1030 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing sk_offset [0x%x]\n",
1031 nk->subkeys_off));
1032 return False;
1033 }
1034 }
1035
1036 if ( !(nk->sec_desc = TALLOC_ZERO_P( file->mem_ctx, REGF_SK_REC )) )
1037 return False;
1038 nk->sec_desc->sk_off = nk->sk_off;
1039 if ( !hbin_prs_sk_rec( "sk_rec", sub_hbin, depth, nk->sec_desc ))
1040 return False;
1041
1042 /* add to the list of security descriptors (ref_count has been read from the files) */
1043
1044 nk->sec_desc->sk_off = nk->sk_off;
1045 DLIST_ADD( file->sec_desc_list, nk->sec_desc );
1046 }
1047
1048 return True;
1049 }
1050
1051 /*******************************************************************
1052 *******************************************************************/
1053
1054 static bool next_record( REGF_HBIN *hbin, const char *hdr, bool *eob )
1055 {
1056 uint8 header[REC_HDR_SIZE];
1057 uint32 record_size;
1058 uint32 curr_off, block_size;
1059 bool found = False;
1060 prs_struct *ps = &hbin->ps;
1061
1062 curr_off = prs_offset( ps );
1063 if ( curr_off == 0 )
1064 prs_set_offset( ps, HBIN_HEADER_REC_SIZE );
1065
1066 /* assume that the current offset is at the record header
1067 and we need to backup to read the record size */
1068
1069 curr_off -= sizeof(uint32);
1070
1071 block_size = prs_data_size( ps );
1072 record_size = 0;
1073 memset( header, 0x0, sizeof(uint8)*REC_HDR_SIZE );
1074 while ( !found ) {
1075
1076 curr_off = curr_off+record_size;
1077 if ( curr_off >= block_size )
1078 break;
1079
1080 if ( !prs_set_offset( &hbin->ps, curr_off) )
1081 return False;
1082
1083 if ( !prs_uint32( "record_size", ps, 0, &record_size ) )
1084 return False;
1085 if ( !prs_uint8s( True, "header", ps, 0, header, REC_HDR_SIZE ) )
1086 return False;
1087
1088 if ( record_size & 0x80000000 ) {
1089 /* absolute_value(record_size) */
1090 record_size = (record_size ^ 0xffffffff) + 1;
1091 }
1092
1093 if ( memcmp( header, hdr, REC_HDR_SIZE ) == 0 ) {
1094 found = True;
1095 curr_off += sizeof(uint32);
1096 }
1097 }
1098
1099 /* mark prs_struct as done ( at end ) if no more SK records */
1100 /* mark end-of-block as True */
1101
1102 if ( !found ) {
1103 prs_set_offset( &hbin->ps, prs_data_size(&hbin->ps) );
1104 *eob = True;
1105 return False;
1106 }
1107
1108 if ( !prs_set_offset( ps, curr_off ) )
1109 return False;
1110
1111 return True;
1112 }
1113
1114 /*******************************************************************
1115 *******************************************************************/
1116
1117 static bool next_nk_record( REGF_FILE *file, REGF_HBIN *hbin, REGF_NK_REC *nk, bool *eob )
1118 {
1119 if ( next_record( hbin, "nk", eob ) && hbin_prs_key( file, hbin, nk ) )
1120 return True;
1121
1122 return False;
1123 }
1124
1125 /*******************************************************************
1126 Intialize the newly created REGF_BLOCK in *file and write the
1127 block header to disk
1128 *******************************************************************/
1129
1130 static bool init_regf_block( REGF_FILE *file )
1131 {
1132 prs_struct ps;
1133 bool result = True;
1134
1135 if ( !prs_init( &ps, REGF_BLOCKSIZE, file->mem_ctx, MARSHALL ) )
1136 return False;
1137
1138 memcpy( file->header, "regf", REGF_HDR_SIZE );
1139 file->data_offset = 0x20;
1140 file->last_block = 0x1000;
1141
1142 /* set mod time */
1143
1144 unix_to_nt_time( &file->mtime, time(NULL) );
1145
1146 /* hard coded values...no diea what these are ... maybe in time */
1147
1148 file->unknown1 = 0x2;
1149 file->unknown2 = 0x1;
1150 file->unknown3 = 0x3;
1151 file->unknown4 = 0x0;
1152 file->unknown5 = 0x1;
1153 file->unknown6 = 0x1;
1154
1155 /* write header to the buffer */
1156
1157 if ( !prs_regf_block( "regf_header", &ps, 0, file ) ) {
1158 result = False;
1159 goto out;
1160 }
1161
1162 /* calculate the checksum, re-marshall data (to include the checksum)
1163 and write to disk */
1164
1165 file->checksum = regf_block_checksum( &ps );
1166 prs_set_offset( &ps, 0 );
1167 if ( !prs_regf_block( "regf_header", &ps, 0, file ) ) {
1168 result = False;
1169 goto out;
1170 }
1171
1172 if ( write_block( file, &ps, 0 ) == -1 ) {
1173 DEBUG(0,("init_regf_block: Failed to initialize registry header block!\n"));
1174 result = False;
1175 goto out;
1176 }
1177
1178 out:
1179 prs_mem_free( &ps );
1180
1181 return result;
1182 }
1183 /*******************************************************************
1184 Open the registry file and then read in the REGF block to get the
1185 first hbin offset.
1186 *******************************************************************/
1187
1188 REGF_FILE* regfio_open( const char *filename, int flags, int mode )
1189 {
1190 REGF_FILE *rb;
1191
1192 if ( !(rb = SMB_MALLOC_P(REGF_FILE)) ) {
1193 DEBUG(0,("ERROR allocating memory\n"));
1194 return NULL;
1195 }
1196 ZERO_STRUCTP( rb );
1197 rb->fd = -1;
1198
1199 if ( !(rb->mem_ctx = talloc_init( "read_regf_block" )) ) {
1200 regfio_close( rb );
1201 return NULL;
1202 }
1203
1204 rb->open_flags = flags;
1205
1206 /* open and existing file */
1207
1208 if ( (rb->fd = open(filename, flags, mode)) == -1 ) {
1209 DEBUG(0,("regfio_open: failure to open %s (%s)\n", filename, strerror(errno)));
1210 regfio_close( rb );
1211 return NULL;
1212 }
1213
1214 /* check if we are creating a new file or overwriting an existing one */
1215
1216 if ( flags & (O_CREAT|O_TRUNC) ) {
1217 if ( !init_regf_block( rb ) ) {
1218 DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));
1219 regfio_close( rb );
1220 return NULL;
1221 }
1222
1223 /* success */
1224 return rb;
1225 }
1226
1227 /* read in an existing file */
1228
1229 if ( !read_regf_block( rb ) ) {
1230 DEBUG(0,("regfio_open: Failed to read initial REGF block\n"));
1231 regfio_close( rb );
1232 return NULL;
1233 }
1234
1235 /* success */
1236
1237 return rb;
1238 }
1239
1240 /*******************************************************************
1241 *******************************************************************/
1242
1243 static void regfio_mem_free( REGF_FILE *file )
1244 {
1245 /* free any talloc()'d memory */
1246
1247 if ( file && file->mem_ctx )
1248 talloc_destroy( file->mem_ctx );
1249 }
1250
1251 /*******************************************************************
1252 *******************************************************************/
1253
1254 int regfio_close( REGF_FILE *file )
1255 {
1256 int fd;
1257
1258 /* cleanup for a file opened for write */
1259
1260 if ((file->fd != -1) && (file->open_flags & (O_WRONLY|O_RDWR))) {
1261 prs_struct ps;
1262 REGF_SK_REC *sk;
1263
1264 /* write of sd list */
1265
1266 for ( sk=file->sec_desc_list; sk; sk=sk->next ) {
1267 hbin_prs_sk_rec( "sk_rec", sk->hbin, 0, sk );
1268 }
1269
1270 /* flush any dirty blocks */
1271
1272 while ( file->block_list ) {
1273 hbin_block_close( file, file->block_list );
1274 }
1275
1276 ZERO_STRUCT( ps );
1277
1278 unix_to_nt_time( &file->mtime, time(NULL) );
1279
1280 if ( read_block( file, &ps, 0, REGF_BLOCKSIZE ) != -1 ) {
1281 /* now use for writing */
1282 prs_switch_type( &ps, MARSHALL );
1283
1284 /* stream the block once, generate the checksum,
1285 and stream it again */
1286 prs_set_offset( &ps, 0 );
1287 prs_regf_block( "regf_blocK", &ps, 0, file );
1288 file->checksum = regf_block_checksum( &ps );
1289 prs_set_offset( &ps, 0 );
1290 prs_regf_block( "regf_blocK", &ps, 0, file );
1291
1292 /* now we are ready to write it to disk */
1293 if ( write_block( file, &ps, 0 ) == -1 )
1294 DEBUG(0,("regfio_close: failed to update the regf header block!\n"));
1295 }
1296
1297 prs_mem_free( &ps );
1298 }
1299
1300 regfio_mem_free( file );
1301
1302 /* nothing tdo do if there is no open file */
1303
1304 if (file->fd == -1)
1305 return 0;
1306
1307 fd = file->fd;
1308 file->fd = -1;
1309 SAFE_FREE( file );
1310
1311 return close( fd );
1312 }
1313
1314 /*******************************************************************
1315 *******************************************************************/
1316
1317 static void regfio_flush( REGF_FILE *file )
1318 {
1319 REGF_HBIN *hbin;
1320
1321 for ( hbin=file->block_list; hbin; hbin=hbin->next ) {
1322 write_hbin_block( file, hbin );
1323 }
1324 }
1325
1326 /*******************************************************************
1327 There should be only *one* root key in the registry file based
1328 on my experience. --jerry
1329 *******************************************************************/
1330
1331 REGF_NK_REC* regfio_rootkey( REGF_FILE *file )
1332 {
1333 REGF_NK_REC *nk;
1334 REGF_HBIN *hbin;
1335 uint32 offset = REGF_BLOCKSIZE;
1336 bool found = False;
1337 bool eob;
1338
1339 if ( !file )
1340 return NULL;
1341
1342 if ( !(nk = TALLOC_ZERO_P( file->mem_ctx, REGF_NK_REC )) ) {
1343 DEBUG(0,("regfio_rootkey: talloc() failed!\n"));
1344 return NULL;
1345 }
1346
1347 /* scan through the file on HBIN block at a time looking
1348 for an NK record with a type == 0x002c.
1349 Normally this is the first nk record in the first hbin
1350 block (but I'm not assuming that for now) */
1351
1352 while ( (hbin = read_hbin_block( file, offset )) ) {
1353 eob = False;
1354
1355 while ( !eob) {
1356 if ( next_nk_record( file, hbin, nk, &eob ) ) {
1357 if ( nk->key_type == NK_TYPE_ROOTKEY ) {
1358 found = True;
1359 break;
1360 }
1361 }
1362 prs_mem_free( &hbin->ps );
1363 }
1364
1365 if ( found )
1366 break;
1367
1368 offset += hbin->block_size;
1369 }
1370
1371 if ( !found ) {
1372 DEBUG(0,("regfio_rootkey: corrupt registry file ? No root key record located\n"));
1373 return NULL;
1374 }
1375
1376 DLIST_ADD( file->block_list, hbin );
1377
1378 return nk;
1379 }
1380
1381 /*******************************************************************
1382 This acts as an interator over the subkeys defined for a given
1383 NK record. Remember that offsets are from the *first* HBIN block.
1384 *******************************************************************/
1385
1386 REGF_NK_REC* regfio_fetch_subkey( REGF_FILE *file, REGF_NK_REC *nk )
1387 {
1388 REGF_NK_REC *subkey;
1389 REGF_HBIN *hbin;
1390 uint32 nk_offset;
1391
1392 /* see if there is anything left to report */
1393
1394 if ( !nk || (nk->subkeys_off==REGF_OFFSET_NONE) || (nk->subkey_index >= nk->num_subkeys) )
1395 return NULL;
1396
1397 /* find the HBIN block which should contain the nk record */
1398
1399 if ( !(hbin = lookup_hbin_block( file, nk->subkeys.hashes[nk->subkey_index].nk_off )) ) {
1400 DEBUG(0,("hbin_prs_key: Failed to find HBIN block containing offset [0x%x]\n",
1401 nk->subkeys.hashes[nk->subkey_index].nk_off));
1402 return NULL;
1403 }
1404
1405 nk_offset = nk->subkeys.hashes[nk->subkey_index].nk_off;
1406 if ( !prs_set_offset( &hbin->ps, (HBIN_HDR_SIZE + nk_offset - hbin->first_hbin_off) ) )
1407 return NULL;
1408
1409 nk->subkey_index++;
1410 if ( !(subkey = TALLOC_ZERO_P( file->mem_ctx, REGF_NK_REC )) )
1411 return NULL;
1412
1413 if ( !hbin_prs_key( file, hbin, subkey ) )
1414 return NULL;
1415
1416 return subkey;
1417 }
1418
1419
1420 /*******************************************************************
1421 *******************************************************************/
1422
1423 static REGF_HBIN* regf_hbin_allocate( REGF_FILE *file, uint32 block_size )
1424 {
1425 REGF_HBIN *hbin;
1426 SMB_STRUCT_STAT sbuf;
1427
1428 if ( !(hbin = TALLOC_ZERO_P( file->mem_ctx, REGF_HBIN )) )
1429 return NULL;
1430
1431 memcpy( hbin->header, "hbin", sizeof(HBIN_HDR_SIZE) );
1432
1433
1434 if (sys_fstat(file->fd, &sbuf, false)) {
1435 DEBUG(0,("regf_hbin_allocate: stat() failed! (%s)\n", strerror(errno)));
1436 return NULL;
1437 }
1438
1439 hbin->file_off = sbuf.st_ex_size;
1440
1441 hbin->free_off = HBIN_HEADER_REC_SIZE;
1442 hbin->free_size = block_size - hbin->free_off + sizeof(uint32);;
1443
1444 hbin->block_size = block_size;
1445 hbin->first_hbin_off = hbin->file_off - REGF_BLOCKSIZE;
1446
1447 if ( !prs_init( &hbin->ps, block_size, file->mem_ctx, MARSHALL ) )
1448 return NULL;
1449
1450 if ( !prs_hbin_block( "new_hbin", &hbin->ps, 0, hbin ) )
1451 return NULL;
1452
1453 if ( !write_hbin_block( file, hbin ) )
1454 return NULL;
1455
1456 file->last_block = hbin->file_off;
1457
1458 return hbin;
1459 }
1460
1461 /*******************************************************************
1462 *******************************************************************/
1463
1464 static void update_free_space( REGF_HBIN *hbin, uint32 size_used )
1465 {
1466 hbin->free_off += size_used;
1467 hbin->free_size -= size_used;
1468
1469 if ( hbin->free_off >= hbin->block_size ) {
1470 hbin->free_off = REGF_OFFSET_NONE;
1471 }
1472
1473 return;
1474 }
1475
1476 /*******************************************************************
1477 *******************************************************************/
1478
1479 static REGF_HBIN* find_free_space( REGF_FILE *file, uint32 size )
1480 {
1481 REGF_HBIN *hbin, *p_hbin;
1482 uint32 block_off;
1483 bool cached;
1484
1485 /* check open block list */
1486
1487 for ( hbin=file->block_list; hbin!=NULL; hbin=hbin->next ) {
1488 /* only check blocks that actually have available space */
1489
1490 if ( hbin->free_off == REGF_OFFSET_NONE )
1491 continue;
1492
1493 /* check for a large enough available chunk */
1494
1495 if ( (hbin->block_size - hbin->free_off) >= size ) {
1496 DLIST_PROMOTE( file->block_list, hbin );
1497 goto done;
1498 }
1499 }
1500
1501 /* parse the file until we find a block with
1502 enough free space; save the last non-filled hbin */
1503
1504 block_off = REGF_BLOCKSIZE;
1505 do {
1506 /* cleanup before the next round */
1507 cached = False;
1508 if ( hbin )
1509 prs_mem_free( &hbin->ps );
1510
1511 hbin = read_hbin_block( file, block_off );
1512
1513 if ( hbin ) {
1514
1515 /* make sure that we don't already have this block in memory */
1516
1517 for ( p_hbin=file->block_list; p_hbin!=NULL; p_hbin=p_hbin->next ) {
1518 if ( p_hbin->file_off == hbin->file_off ) {
1519 cached = True;
1520 break;
1521 }
1522 }
1523
1524 block_off = hbin->file_off + hbin->block_size;
1525
1526 if ( cached ) {
1527 prs_mem_free( &hbin->ps );
1528 hbin = NULL;
1529 continue;
1530 }
1531 }
1532 /* if (cached block or (new block and not enough free space)) then continue looping */
1533 } while ( cached || (hbin && (hbin->free_size < size)) );
1534
1535 /* no free space; allocate a new one */
1536
1537 if ( !hbin ) {
1538 uint32 alloc_size;
1539
1540 /* allocate in multiples of REGF_ALLOC_BLOCK; make sure (size + hbin_header) fits */
1541
1542 alloc_size = (((size+HBIN_HEADER_REC_SIZE) / REGF_ALLOC_BLOCK ) + 1 ) * REGF_ALLOC_BLOCK;
1543
1544 if ( !(hbin = regf_hbin_allocate( file, alloc_size )) ) {
1545 DEBUG(0,("find_free_space: regf_hbin_allocate() failed!\n"));
1546 return NULL;
1547 }
1548 DLIST_ADD( file->block_list, hbin );
1549 }
1550
1551 done:
1552 /* set the offset to be ready to write */
1553
1554 if ( !prs_set_offset( &hbin->ps, hbin->free_off-sizeof(uint32) ) )
1555 return NULL;
1556
1557 /* write the record size as a placeholder for now, it should be
1558 probably updated by the caller once it all of the data necessary
1559 for the record */
1560
1561 if ( !prs_uint32("allocated_size", &hbin->ps, 0, &size) )
1562 return False;
1563
1564 update_free_space( hbin, size );
1565
1566 return hbin;
1567 }
1568
1569 /*******************************************************************
1570 *******************************************************************/
1571
1572 static uint32 sk_record_data_size( struct security_descriptor * sd )
1573 {
1574 uint32 size, size_mod8;
1575
1576 size_mod8 = 0;
1577
1578 /* the record size is sizeof(hdr) + name + static members + data_size_field */
1579
1580 size = sizeof(uint32)*5 + ndr_size_security_descriptor(sd, 0) + sizeof(uint32);
1581
1582 /* multiple of 8 */
1583 size_mod8 = size & 0xfffffff8;
1584 if ( size_mod8 < size )
1585 size_mod8 += 8;
1586
1587 return size_mod8;
1588 }
1589
1590 /*******************************************************************
1591 *******************************************************************/
1592
1593 static uint32 vk_record_data_size( REGF_VK_REC *vk )
1594 {
1595 uint32 size, size_mod8;
1596
1597 size_mod8 = 0;
1598
1599 /* the record size is sizeof(hdr) + name + static members + data_size_field */
1600
1601 size = REC_HDR_SIZE + (sizeof(uint16)*3) + (sizeof(uint32)*3) + sizeof(uint32);
1602
1603 if ( vk->valuename )
1604 size += strlen(vk->valuename);
1605
1606 /* multiple of 8 */
1607 size_mod8 = size & 0xfffffff8;
1608 if ( size_mod8 < size )
1609 size_mod8 += 8;
1610
1611 return size_mod8;
1612 }
1613
1614 /*******************************************************************
1615 *******************************************************************/
1616
1617 static uint32 lf_record_data_size( uint32 num_keys )
1618 {
1619 uint32 size, size_mod8;
1620
1621 size_mod8 = 0;
1622
1623 /* the record size is sizeof(hdr) + num_keys + sizeof of hash_array + data_size_uint32 */
1624
1625 size = REC_HDR_SIZE + sizeof(uint16) + (sizeof(REGF_HASH_REC) * num_keys) + sizeof(uint32);
1626
1627 /* multiple of 8 */
1628 size_mod8 = size & 0xfffffff8;
1629 if ( size_mod8 < size )
1630 size_mod8 += 8;
1631
1632 return size_mod8;
1633 }
1634
1635 /*******************************************************************
1636 *******************************************************************/
1637
1638 static uint32 nk_record_data_size( REGF_NK_REC *nk )
1639 {
1640 uint32 size, size_mod8;
1641
1642 size_mod8 = 0;
1643
1644 /* the record size is static + length_of_keyname + length_of_classname + data_size_uint32 */
1645
1646 size = 0x4c + strlen(nk->keyname) + sizeof(uint32);
1647
1648 if ( nk->classname )
1649 size += strlen( nk->classname );
1650
1651 /* multiple of 8 */
1652 size_mod8 = size & 0xfffffff8;
1653 if ( size_mod8 < size )
1654 size_mod8 += 8;
1655
1656 return size_mod8;
1657 }
1658
1659 /*******************************************************************
1660 *******************************************************************/
1661
1662 static bool create_vk_record(REGF_FILE *file, REGF_VK_REC *vk,
1663 struct regval_blob *value)
1664 {
1665 char *name = regval_name(value);
1666 REGF_HBIN *data_hbin;
1667
1668 ZERO_STRUCTP( vk );
1669
1670 memcpy( vk->header, "vk", REC_HDR_SIZE );
1671
1672 if ( name ) {
1673 vk->valuename = talloc_strdup( file->mem_ctx, regval_name(value) );
1674 vk->flag = VK_FLAG_NAME_PRESENT;
1675 }
1676
1677 vk->data_size = regval_size( value );
1678 vk->type = regval_type( value );
1679
1680 if ( vk->data_size > sizeof(uint32) ) {
1681 uint32 data_size = ( (vk->data_size+sizeof(uint32)) & 0xfffffff8 ) + 8;
1682
1683 vk->data = (uint8 *)TALLOC_MEMDUP( file->mem_ctx,
1684 regval_data_p(value),
1685 vk->data_size );
1686 if (vk->data == NULL) {
1687 return False;
1688 }
1689
1690 /* go ahead and store the offset....we'll pick this hbin block back up when
1691 we stream the data */
1692
1693 if ((data_hbin = find_free_space(file, data_size )) == NULL) {
1694 return False;
1695 }
1696 vk->data_off = prs_offset( &data_hbin->ps ) + data_hbin->first_hbin_off - HBIN_HDR_SIZE;
1697 }
1698 else {
1699 /* make sure we don't try to copy from a NULL value pointer */
1700
1701 if ( vk->data_size != 0 )
1702 memcpy( &vk->data_off, regval_data_p(value), sizeof(uint32) );
1703 vk->data_size |= VK_DATA_IN_OFFSET;
1704 }
1705
1706 return True;
1707 }
1708
1709 /*******************************************************************
1710 *******************************************************************/
1711
1712 static int hashrec_cmp( REGF_HASH_REC *h1, REGF_HASH_REC *h2 )
1713 {
1714 return StrCaseCmp( h1->fullname, h2->fullname );
1715 }
1716
1717 /*******************************************************************
1718 *******************************************************************/
1719
1720 REGF_NK_REC* regfio_write_key( REGF_FILE *file, const char *name,
1721 struct regval_ctr *values, struct regsubkey_ctr *subkeys,
1722 struct security_descriptor *sec_desc, REGF_NK_REC *parent )
1723 {
1724 REGF_NK_REC *nk;
1725 REGF_HBIN *vlist_hbin = NULL;
1726 uint32 size;
1727
1728 if ( !(nk = TALLOC_ZERO_P( file->mem_ctx, REGF_NK_REC )) )
1729 return NULL;
1730
1731 memcpy( nk->header, "nk", REC_HDR_SIZE );
1732
1733 if ( !parent )
1734 nk->key_type = NK_TYPE_ROOTKEY;
1735 else
1736 nk->key_type = NK_TYPE_NORMALKEY;
1737
1738 /* store the parent offset (or -1 if a the root key */
1739
1740 nk->parent_off = parent ? (parent->hbin_off + parent->hbin->file_off - REGF_BLOCKSIZE - HBIN_HDR_SIZE ) : REGF_OFFSET_NONE;
1741
1742 /* no classname currently */
1743
1744 nk->classname_off = REGF_OFFSET_NONE;
1745 nk->classname = NULL;
1746 nk->keyname = talloc_strdup( file->mem_ctx, name );
1747
1748 /* current modification time */
1749
1750 unix_to_nt_time( &nk->mtime, time(NULL) );
1751
1752 /* allocate the record on disk */
1753
1754 size = nk_record_data_size( nk );
1755 nk->rec_size = ( size - 1 ) ^ 0XFFFFFFFF;
1756 if ((nk->hbin = find_free_space( file, size )) == NULL) {
1757 return NULL;
1758 }
1759 nk->hbin_off = prs_offset( &nk->hbin->ps );
1760
1761 /* Update the hash record in the parent */
1762
1763 if ( parent ) {
1764 REGF_HASH_REC *hash = &parent->subkeys.hashes[parent->subkey_index];
1765
1766 hash->nk_off = prs_offset( &nk->hbin->ps ) + nk->hbin->first_hbin_off - HBIN_HDR_SIZE;
1767 memcpy( hash->keycheck, name, sizeof(uint32) );
1768 hash->fullname = talloc_strdup( file->mem_ctx, name );
1769 parent->subkey_index++;
1770
1771 /* sort the list by keyname */
1772 TYPESAFE_QSORT(parent->subkeys.hashes, parent->subkey_index, hashrec_cmp);
1773
1774 if ( !hbin_prs_lf_records( "lf_rec", parent->subkeys.hbin, 0, parent ) )
1775 return False;
1776 }
1777
1778 /* write the security descriptor */
1779
1780 nk->sk_off = REGF_OFFSET_NONE;
1781 if ( sec_desc ) {
1782 uint32 sk_size = sk_record_data_size( sec_desc );
1783 REGF_HBIN *sk_hbin;
1784
1785 /* search for it in the existing list of sd's */
1786
1787 if ( (nk->sec_desc = find_sk_record_by_sec_desc( file, sec_desc )) == NULL ) {
1788 /* not found so add it to the list */
1789
1790 if (!(sk_hbin = find_free_space( file, sk_size ))) {
1791 return NULL;
1792 }
1793
1794 if ( !(nk->sec_desc = TALLOC_ZERO_P( file->mem_ctx, REGF_SK_REC )) )
1795 return NULL;
1796
1797 /* now we have to store the security descriptor in the list and
1798 update the offsets */
1799
1800 memcpy( nk->sec_desc->header, "sk", REC_HDR_SIZE );
1801 nk->sec_desc->hbin = sk_hbin;
1802 nk->sec_desc->hbin_off = prs_offset( &sk_hbin->ps );
1803 nk->sec_desc->sk_off = prs_offset( &sk_hbin->ps ) + sk_hbin->first_hbin_off - HBIN_HDR_SIZE;
1804 nk->sec_desc->rec_size = (sk_size-1) ^ 0xFFFFFFFF;
1805
1806 nk->sec_desc->sec_desc = sec_desc;
1807 nk->sec_desc->ref_count = 0;
1808
1809 /* size value must be self-inclusive */
1810 nk->sec_desc->size = ndr_size_security_descriptor(sec_desc, 0)
1811 + sizeof(uint32);
1812
1813 DLIST_ADD_END( file->sec_desc_list, nk->sec_desc, REGF_SK_REC *);
1814
1815 /* update the offsets for us and the previous sd in the list.
1816 if this is the first record, then just set the next and prev
1817 offsets to ourself. */
1818
1819 if ( DLIST_PREV(nk->sec_desc) ) {
1820 REGF_SK_REC *prev = DLIST_PREV(nk->sec_desc);
1821
1822 nk->sec_desc->prev_sk_off = prev->hbin_off + prev->hbin->first_hbin_off - HBIN_HDR_SIZE;
1823 prev->next_sk_off = nk->sec_desc->sk_off;
1824
1825 /* the end must loop around to the front */
1826 nk->sec_desc->next_sk_off = file->sec_desc_list->sk_off;
1827
1828 /* and first must loop around to the tail */
1829 file->sec_desc_list->prev_sk_off = nk->sec_desc->sk_off;
1830 } else {
1831 nk->sec_desc->prev_sk_off = nk->sec_desc->sk_off;
1832 nk->sec_desc->next_sk_off = nk->sec_desc->sk_off;
1833 }
1834 }
1835
1836 /* bump the reference count +1 */
1837
1838 nk->sk_off = nk->sec_desc->sk_off;
1839 nk->sec_desc->ref_count++;
1840 }
1841
1842 /* write the subkeys */
1843
1844 nk->subkeys_off = REGF_OFFSET_NONE;
1845 if ( (nk->num_subkeys = regsubkey_ctr_numkeys( subkeys )) != 0 ) {
1846 uint32 lf_size = lf_record_data_size( nk->num_subkeys );
1847 uint32 namelen;
1848 int i;
1849
1850 if (!(nk->subkeys.hbin = find_free_space( file, lf_size ))) {
1851 return NULL;
1852 }
1853 nk->subkeys.hbin_off = prs_offset( &nk->subkeys.hbin->ps );
1854 nk->subkeys.rec_size = (lf_size-1) ^ 0xFFFFFFFF;
1855 nk->subkeys_off = prs_offset( &nk->subkeys.hbin->ps ) + nk->subkeys.hbin->first_hbin_off - HBIN_HDR_SIZE;
1856
1857 memcpy( nk->subkeys.header, "lf", REC_HDR_SIZE );
1858
1859 nk->subkeys.num_keys = nk->num_subkeys;
1860 if (nk->subkeys.num_keys) {
1861 if ( !(nk->subkeys.hashes = TALLOC_ZERO_ARRAY( file->mem_ctx, REGF_HASH_REC, nk->subkeys.num_keys )) )
1862 return NULL;
1863 } else {
1864 nk->subkeys.hashes = NULL;
1865 }
1866 nk->subkey_index = 0;
1867
1868 /* update the max_bytes_subkey{name,classname} fields */
1869 for ( i=0; i<nk->num_subkeys; i++ ) {
1870 namelen = strlen( regsubkey_ctr_specific_key(subkeys, i) );
1871 if ( namelen*2 > nk->max_bytes_subkeyname )
1872 nk->max_bytes_subkeyname = namelen * 2;
1873 }
1874 }
1875
1876 /* write the values */
1877
1878 nk->values_off = REGF_OFFSET_NONE;
1879 if ( (nk->num_values = regval_ctr_numvals( values )) != 0 ) {
1880 uint32 vlist_size = ( ( nk->num_values * sizeof(uint32) ) & 0xfffffff8 ) + 8;
1881 int i;
1882
1883 if (!(vlist_hbin = find_free_space( file, vlist_size ))) {
1884 return NULL;
1885 }
1886 nk->values_off = prs_offset( &vlist_hbin->ps ) + vlist_hbin->first_hbin_off - HBIN_HDR_SIZE;
1887
1888 if (nk->num_values) {
1889 if ( !(nk->values = TALLOC_ARRAY( file->mem_ctx, REGF_VK_REC, nk->num_values )) )
1890 return NULL;
1891 } else {
1892 nk->values = NULL;
1893 }
1894
1895 /* create the vk records */
1896
1897 for ( i=0; i<nk->num_values; i++ ) {
1898 uint32 vk_size, namelen, datalen;
1899 struct regval_blob *r;
1900
1901 r = regval_ctr_specific_value( values, i );
1902 create_vk_record( file, &nk->values[i], r );
1903 vk_size = vk_record_data_size( &nk->values[i] );
1904 nk->values[i].hbin = find_free_space( file, vk_size );
1905 nk->values[i].hbin_off = prs_offset( &nk->values[i].hbin->ps );
1906 nk->values[i].rec_size = ( vk_size - 1 ) ^ 0xFFFFFFFF;
1907 nk->values[i].rec_off = prs_offset( &nk->values[i].hbin->ps )
1908 + nk->values[i].hbin->first_hbin_off
1909 - HBIN_HDR_SIZE;
1910
1911 /* update the max bytes fields if necessary */
1912
1913 namelen = strlen( regval_name(r) );
1914 if ( namelen*2 > nk->max_bytes_valuename )
1915 nk->max_bytes_valuename = namelen * 2;
1916
1917 datalen = regval_size( r );
1918 if ( datalen > nk->max_bytes_value )
1919 nk->max_bytes_value = datalen;
1920 }
1921 }
1922
1923 /* stream the records */
1924
1925 prs_set_offset( &nk->hbin->ps, nk->hbin_off );
1926 if ( !prs_nk_rec( "nk_rec", &nk->hbin->ps, 0, nk ) )
1927 return False;
1928
1929 if ( nk->num_values ) {
1930 if ( !hbin_prs_vk_records( "vk_records", vlist_hbin, 0, nk, file ) )
1931 return False;
1932 }
1933
1934
1935 regfio_flush( file );
1936
1937 return nk;
1938 }
1939