Changeset 745 for trunk/server/source4/lib/registry/regf.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/lib/registry/regf.c (modified) (71 diffs)

trunk/server/source4/lib/registry/regf.c

@@ -3 +3 @@
    Registry backend for REGF files
    Copyright (C) 2005-2007 Jelmer Vernooij, jelmer@samba.org
-   Copyright (C) 2006 Wilco Baan Hofman, wilco@baanhofman.nl
+   Copyright (C) 2006-2010 Wilco Baan Hofman, wilco@baanhofman.nl
 
    This program is free software; you can redistribute it and/or modify
@@ -50 +50 @@
         struct hbin_block **hbins;
         struct regf_hdr *header;
-        struct smb_iconv_convenience *iconv_convenience;
+        time_t last_write;
 };
 
-static WERROR regf_save_hbin(struct regf_data *data);
+static WERROR regf_save_hbin(struct regf_data *data, bool flush);
 
 struct regf_key_data {
@@ -65 +65 @@
                                          uint32_t offset, uint32_t *rel_offset)
 {
-        int i;
+        unsigned int i;
 
         for (i = 0; data->hbins[i]; i++) {
@@ -87 +87 @@
 {
         uint32_t checksum = 0, x;
-        int i;
+        unsigned int i;
 
         for (i = 0; i < 0x01FB; i+= 4) {
@@ -112 +112 @@
 
         if (hbin == NULL) {
-                DEBUG(1, ("Can't find HBIN containing 0x%04x\n", offset));
+                DEBUG(1, ("Can't find HBIN at 0x%04x\n", offset));
                 return ret;
         }
@@ -135 +135 @@
                          TALLOC_CTX *ctx, tdr_pull_fn_t pull_fn, void *p)
 {
-        struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
+        struct tdr_pull *pull = tdr_pull_init(regf);
 
         pull->data = hbin_get(regf, offset);
@@ -160 +160 @@
 {
         DATA_BLOB ret;
-        uint32_t rel_offset = -1; /* Relative offset ! */
+        uint32_t rel_offset = (uint32_t) -1; /* Relative offset ! */
         struct hbin_block *hbin = NULL;
-        int i;
+        unsigned int i;
 
         *offset = 0;
@@ -218 +218 @@
                 DEBUG(4, ("No space available in other HBINs for block of size %d, allocating new HBIN\n",
                         size));
+
+                /* Add extra hbin block */
                 data->hbins = talloc_realloc(data, data->hbins,
                                              struct hbin_block *, i+2);
@@ -226 +228 @@
                 data->hbins[i+1] = NULL;
 
+                /* Set hbin data */
                 hbin->HBIN_ID = talloc_strdup(hbin, "hbin");
                 hbin->offset_from_first = (i == 0?0:data->hbins[i-1]->offset_from_first+data->hbins[i-1]->offset_to_next);
                 hbin->offset_to_next = 0x1000;
                 hbin->unknown[0] = 0;
-                hbin->unknown[0] = 0;
+                hbin->unknown[1] = 0;
                 unix_to_nt_time(&hbin->last_change, time(NULL));
                 hbin->block_size = hbin->offset_to_next;
                 hbin->data = talloc_zero_array(hbin, uint8_t, hbin->block_size - 0x20);
-
+                /* Update the regf header */
+                data->header->last_block += hbin->offset_to_next;
+
+                /* Set the next block to it's proper size and set the
+                 * rel_offset for this block */
+                SIVAL(hbin->data, size, hbin->block_size - size - 0x20);
                 rel_offset = 0x0;
-                SIVAL(hbin->data, size, hbin->block_size - size - 0x20);
         }
 
@@ -262 +269 @@
         memcpy(dest.data, blob.data, blob.length);
 
+        /* Make sure that we have no tailing garbage in the block */
+        if (dest.length > blob.length) {
+                memset(dest.data + blob.length, 0, dest.length - blob.length);
+        }
+
         return ret;
 }
@@ -268 +280 @@
                                tdr_push_fn_t push_fn, void *p)
 {
-        struct tdr_push *push = tdr_push_init(data, data->iconv_convenience);
+        struct tdr_push *push = tdr_push_init(data);
         uint32_t ret;
 
@@ -311 +323 @@
 
         /* If the next block is free, merge into big free block */
-        if (rel_offset + size < hbin->offset_to_next) {
+        if (rel_offset + size < hbin->offset_to_next - 0x20) {
                 next_size = IVALS(hbin->data, rel_offset+size);
                 if (next_size > 0) {
@@ -336 +348 @@
         int32_t needed_size;
         int32_t possible_size;
-        int i;
+        unsigned int i;
 
         SMB_ASSERT(orig_offset > 0);
@@ -395 +407 @@
                                       uint32_t orig_offset, void *p)
 {
-        struct tdr_push *push = tdr_push_init(regf, regf->iconv_convenience);
+        struct tdr_push *push = tdr_push_init(regf);
         uint32_t ret;
 
@@ -451 +463 @@
                                                     (char*)data.data,
                                                     private_data->nk->clsname_length);
+                        W_ERROR_HAVE_NO_MEMORY(*classname);
                 } else
                         *classname = NULL;
@@ -485 +498 @@
         if (!hbin_get_tdr(regf, offset, nk,
                           (tdr_pull_fn_t)tdr_pull_nk_block, nk)) {
-                DEBUG(0, ("Unable to find HBIN data for offset %d\n", offset));
+                DEBUG(0, ("Unable to find HBIN data for offset 0x%x\n", offset));
                 return NULL;
         }
@@ -500 +513 @@
 
 static WERROR regf_get_value(TALLOC_CTX *ctx, struct hive_key *key,
-                             int idx, const char **name,
+                             uint32_t idx, const char **name,
                              uint32_t *data_type, DATA_BLOB *data)
 {
@@ -515 +528 @@
         tmp = hbin_get(regf, private_data->nk->values_offset);
         if (!tmp.data) {
-                DEBUG(0, ("Unable to find value list\n"));
+                DEBUG(0, ("Unable to find value list at 0x%x\n",
+                                private_data->nk->values_offset));
                 return WERR_GENERAL_FAILURE;
         }
@@ -530 +544 @@
         if (!hbin_get_tdr(regf, vk_offset, vk,
                           (tdr_pull_fn_t)tdr_pull_vk_block, vk)) {
-                DEBUG(0, ("Unable to get VK block at %d\n", vk_offset));
+                DEBUG(0, ("Unable to get VK block at 0x%x\n", vk_offset));
                 talloc_free(vk);
                 return WERR_GENERAL_FAILURE;
@@ -536 +550 @@
 
         /* FIXME: name character set ?*/
-        if (name != NULL)
+        if (name != NULL) {
                 *name = talloc_strndup(ctx, vk->data_name, vk->name_length);
+                W_ERROR_HAVE_NO_MEMORY(*name);
+        }
 
         if (data_type != NULL)
@@ -543 +559 @@
 
         if (vk->data_length & 0x80000000) {
-                vk->data_length &=~0x80000000;
-                data->data = (uint8_t *)talloc_memdup(ctx, (uint8_t *)&vk->data_offset, vk->data_length);
-                data->length = vk->data_length;
+                /* this is data of type "REG_DWORD" or "REG_DWORD_BIG_ENDIAN" */
+                data->data = talloc_size(ctx, sizeof(uint32_t));
+                W_ERROR_HAVE_NO_MEMORY(data->data);
+                SIVAL(data->data, 0, vk->data_offset);
+                data->length = sizeof(uint32_t);
         } else {
                 *data = hbin_get(regf, vk->data_offset);
@@ -563 +581 @@
                                      uint32_t *type, DATA_BLOB *data)
 {
-        int i;
+        unsigned int i;
         const char *vname;
         WERROR error;
@@ -598 +616 @@
                 return WERR_NO_MORE_ITEMS;
 
+        /* Make sure that we don't crash if the key is empty */
+        if (nk->subkeys_offset == -1) {
+                return WERR_NO_MORE_ITEMS;
+        }
+
         data = hbin_get(private_data->hive, nk->subkeys_offset);
         if (!data.data) {
-                DEBUG(0, ("Unable to find subkey list\n"));
+                DEBUG(0, ("Unable to find subkey list at 0x%x\n",
+                        nk->subkeys_offset));
                 return WERR_GENERAL_FAILURE;
         }
@@ -606 +630 @@
         if (!strncmp((char *)data.data, "li", 2)) {
                 struct li_block li;
-                struct tdr_pull *pull = tdr_pull_init(private_data->hive, private_data->hive->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(private_data->hive);
 
                 DEBUG(10, ("Subkeys in LI list\n"));
@@ -627 +651 @@
         } else if (!strncmp((char *)data.data, "lf", 2)) {
                 struct lf_block lf;
-                struct tdr_pull *pull = tdr_pull_init(private_data->hive, private_data->hive->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(private_data->hive);
 
                 DEBUG(10, ("Subkeys in LF list\n"));
@@ -648 +672 @@
         } else if (!strncmp((char *)data.data, "lh", 2)) {
                 struct lh_block lh;
-                struct tdr_pull *pull = tdr_pull_init(private_data->hive, private_data->hive->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(private_data->hive);
 
                 DEBUG(10, ("Subkeys in LH list\n"));
@@ -668 +692 @@
         } else if (!strncmp((char *)data.data, "ri", 2)) {
                 struct ri_block ri;
-                struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(ctx);
                 uint16_t i;
                 uint16_t sublist_count = 0;
@@ -769 +793 @@
                                                     (char*)db.data,
                                                     ret->nk->clsname_length);
+                        W_ERROR_HAVE_NO_MEMORY(*classname);
                 } else
                         *classname = NULL;
@@ -801 +826 @@
         }
 
-        pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
+        pull = tdr_pull_init(ctx);
 
         pull->data = subkey_data;
@@ -836 +861 @@
         uint32_t key_off = 0;
 
+        /* Make sure that we don't crash if the key is empty */
+        if (nk->subkeys_offset == -1) {
+                return WERR_BADFILE;
+        }
+
         data = hbin_get(private_data->hive, nk->subkeys_offset);
         if (!data.data) {
@@ -844 +874 @@
         if (!strncmp((char *)data.data, "li", 2)) {
                 struct li_block li;
-                struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(ctx);
                 uint16_t i;
 
@@ -875 +905 @@
         } else if (!strncmp((char *)data.data, "lf", 2)) {
                 struct lf_block lf;
-                struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(ctx);
                 uint16_t i;
 
@@ -910 +940 @@
         } else if (!strncmp((char *)data.data, "lh", 2)) {
                 struct lh_block lh;
-                struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(ctx);
                 uint16_t i;
                 uint32_t hash;
@@ -947 +977 @@
         } else if (!strncmp((char *)data.data, "ri", 2)) {
                 struct ri_block ri;
-                struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(ctx);
                 uint16_t i, j;
 
@@ -1052 +1082 @@
 
         /* Push the security descriptor to a blob */
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(&data, regf, NULL, 
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(&data, regf, 
                                                           sec_desc, (ndr_push_flags_fn_t)ndr_push_security_descriptor))) {
                 DEBUG(0, ("Unable to push security descriptor\n"));
@@ -1205 +1235 @@
         data.data = sk.sec_desc;
         data.length = sk.rec_size;
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_pull_struct_blob(&data, ctx, NULL, *sd,
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_pull_struct_blob(&data, ctx, *sd,
                                                   (ndr_pull_flags_fn_t)ndr_pull_security_descriptor))) {
                 DEBUG(0, ("Error parsing security descriptor\n"));
@@ -1289 +1319 @@
 
         if (!strncmp((char *)data.data, "li", 2)) {
-                struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(regf);
                 struct li_block li;
+                struct nk_block sub_nk;
+                int32_t i, j;
 
                 pull->data = data;
@@ -1307 +1339 @@
                 }
 
+                /* 
+                 * Find the position to store the pointer
+                 * Extensive testing reveils that at least on windows 7 subkeys 
+                 * *MUST* be stored in alphabetical order
+                 */
+                for (i = 0; i < li.key_count; i++) {
+                        /* Get the nk */
+                        hbin_get_tdr(regf, li.nk_offset[i], regf,
+                                        (tdr_pull_fn_t) tdr_pull_nk_block, &sub_nk);
+                        if (strcasecmp(name, sub_nk.key_name) < 0) {
+                                break;
+                        }
+                }
+
                 li.nk_offset = talloc_realloc(regf, li.nk_offset,
                                               uint32_t, li.key_count+1);
                 W_ERROR_HAVE_NO_MEMORY(li.nk_offset);
-                li.nk_offset[li.key_count] = key_offset;
+
+                /* Move everything behind this offset */
+                for (j = li.key_count - 1; j >= i; j--) {
+                        li.nk_offset[j+1] = li.nk_offset[j];
+                }
+                        
+                li.nk_offset[i] = key_offset;
                 li.key_count++;
                 *ret = hbin_store_tdr_resize(regf,
@@ -1318 +1370 @@
                 talloc_free(li.nk_offset);
         } else if (!strncmp((char *)data.data, "lf", 2)) {
-                struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(regf);
                 struct lf_block lf;
+                struct nk_block sub_nk;
+                int32_t i, j;
 
                 pull->data = data;
@@ -1331 +1385 @@
                 SMB_ASSERT(!strncmp(lf.header, "lf", 2));
 
+                /* 
+                 * Find the position to store the hash record
+                 * Extensive testing reveils that at least on windows 7 subkeys 
+                 * *MUST* be stored in alphabetical order
+                 */
+                for (i = 0; i < lf.key_count; i++) {
+                        /* Get the nk */
+                        hbin_get_tdr(regf, lf.hr[i].nk_offset, regf,
+                                        (tdr_pull_fn_t) tdr_pull_nk_block, &sub_nk);
+                        if (strcasecmp(name, sub_nk.key_name) < 0) {
+                                break;
+                        }
+                }
+
                 lf.hr = talloc_realloc(regf, lf.hr, struct hash_record,
                                        lf.key_count+1);
                 W_ERROR_HAVE_NO_MEMORY(lf.hr);
-                lf.hr[lf.key_count].nk_offset = key_offset;
-                lf.hr[lf.key_count].hash = talloc_strndup(lf.hr, name, 4);
+
+                /* Move everything behind this hash record */
+                for (j = lf.key_count - 1; j >= i; j--) {
+                        lf.hr[j+1] = lf.hr[j];
+                }
+
+                lf.hr[i].nk_offset = key_offset;
+                lf.hr[i].hash = talloc_strndup(lf.hr, name, 4);
                 W_ERROR_HAVE_NO_MEMORY(lf.hr[lf.key_count].hash);
                 lf.key_count++;
@@ -1344 +1418 @@
                 talloc_free(lf.hr);
         } else if (!strncmp((char *)data.data, "lh", 2)) {
-                struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(regf);
                 struct lh_block lh;
+                struct nk_block sub_nk;
+                int32_t i, j;
 
                 pull->data = data;
@@ -1357 +1433 @@
                 SMB_ASSERT(!strncmp(lh.header, "lh", 2));
 
+                /* 
+                 * Find the position to store the hash record
+                 * Extensive testing reveils that at least on windows 7 subkeys 
+                 * *MUST* be stored in alphabetical order
+                 */
+                for (i = 0; i < lh.key_count; i++) {
+                        /* Get the nk */
+                        hbin_get_tdr(regf, lh.hr[i].nk_offset, regf,
+                                        (tdr_pull_fn_t) tdr_pull_nk_block, &sub_nk);
+                        if (strcasecmp(name, sub_nk.key_name) < 0) {
+                                break;
+                        }
+                }
+
                 lh.hr = talloc_realloc(regf, lh.hr, struct lh_hash,
                                        lh.key_count+1);
                 W_ERROR_HAVE_NO_MEMORY(lh.hr);
-                lh.hr[lh.key_count].nk_offset = key_offset;
-                lh.hr[lh.key_count].base37 = regf_create_lh_hash(name);
+
+                /* Move everything behind this hash record */
+                for (j = lh.key_count - 1; j >= i; j--) {
+                        lh.hr[j+1] = lh.hr[j];
+                }
+
+                lh.hr[i].nk_offset = key_offset;
+                lh.hr[i].base37 = regf_create_lh_hash(name);
                 lh.key_count++;
                 *ret = hbin_store_tdr_resize(regf,
@@ -1393 +1489 @@
         if (strncmp((char *)data.data, "li", 2) == 0) {
                 struct li_block li;
-                struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(regf);
                 uint16_t i;
                 bool found_offset = false;
@@ -1437 +1533 @@
         } else if (strncmp((char *)data.data, "lf", 2) == 0) {
                 struct lf_block lf;
-                struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(regf);
                 uint16_t i;
                 bool found_offset = false;
@@ -1483 +1579 @@
         } else if (strncmp((char *)data.data, "lh", 2) == 0) {
                 struct lh_block lh;
-                struct tdr_pull *pull = tdr_pull_init(regf, regf->iconv_convenience);
+                struct tdr_pull *pull = tdr_pull_init(regf);
                 uint16_t i;
                 bool found_offset = false;
@@ -1538 +1634 @@
 }
 
-static WERROR regf_del_value (struct hive_key *key, const char *name)
+static WERROR regf_del_value(TALLOC_CTX *mem_ctx, struct hive_key *key,
+                             const char *name)
 {
         struct regf_key_data *private_data = (struct regf_key_data *)key;
@@ -1547 +1644 @@
         bool found_offset = false;
         DATA_BLOB values;
-        uint32_t i;
+        unsigned int i;
 
         if (nk->values_offset == -1) {
@@ -1592 +1689 @@
                               private_data->offset, nk);
 
-        return regf_save_hbin(private_data->hive);
-}
-
-
-static WERROR regf_del_key(const struct hive_key *parent, const char *name)
+        return regf_save_hbin(private_data->hive, 0);
+}
+
+
+static WERROR regf_del_key(TALLOC_CTX *mem_ctx, const struct hive_key *parent,
+                           const char *name)
 {
         const struct regf_key_data *private_data =
@@ -1623 +1721 @@
                 char *sk_name;
                 struct hive_key *sk = (struct hive_key *)key;
-                int i = key->nk->num_subkeys;
+                unsigned int i = key->nk->num_subkeys;
                 while (i--) {
                         /* Get subkey information. */
@@ -1635 +1733 @@
 
                         /* Delete subkey. */
-                        error = regf_del_key(sk, sk_name);
+                        error = regf_del_key(NULL, sk, sk_name);
                         if (!W_ERROR_IS_OK(error)) {
                                 DEBUG(0, ("Can't delete key '%s'.\n", sk_name));
@@ -1649 +1747 @@
                 struct hive_key *sk = (struct hive_key *)key;
                 DATA_BLOB data;
-                int i = key->nk->num_values;
+                unsigned int i = key->nk->num_values;
                 while (i--) {
                         /* Get value information. */
@@ -1661 +1759 @@
 
                         /* Delete value. */
-                        error = regf_del_value(sk, val_name);
+                        error = regf_del_value(NULL, sk, val_name);
                         if (!W_ERROR_IS_OK(error)) {
                                 DEBUG(0, ("Can't delete value '%s'.\n", val_name));
@@ -1690 +1788 @@
         hbin_free(private_data->hive, key->offset);
 
-        return regf_save_hbin(private_data->hive);
+        return regf_save_hbin(private_data->hive, 0);
 }
 
@@ -1717 +1815 @@
         nk.num_values = 0;
         nk.values_offset = -1;
-        memset(nk.unk3, 0, 5);
+        memset(nk.unk3, 0, sizeof(nk.unk3));
         nk.clsname_offset = -1; /* FIXME: fill in */
         nk.clsname_length = 0;
@@ -1728 +1826 @@
         if (!hbin_get_tdr(regf, regf->header->data_offset, root,
                           (tdr_pull_fn_t)tdr_pull_nk_block, root)) {
-                DEBUG(0, ("Unable to find HBIN data for offset %d\n",
+                DEBUG(0, ("Unable to find HBIN data for offset 0x%x\n",
                         regf->header->data_offset));
                 return WERR_GENERAL_FAILURE;
@@ -1753 +1851 @@
         *ret = (struct hive_key *)regf_get_key(ctx, regf, offset);
 
-        return regf_save_hbin(private_data->hive);
+        DEBUG(9, ("Storing key %s\n", name));
+        return regf_save_hbin(private_data->hive, 0);
 }
 
@@ -1764 +1863 @@
         struct vk_block vk;
         uint32_t i;
-        uint32_t tmp_vk_offset, vk_offset, old_vk_offset = -1;
+        uint32_t tmp_vk_offset, vk_offset, old_vk_offset = (uint32_t) -1;
         DATA_BLOB values;
 
@@ -1778 +1877 @@
                                           (tdr_pull_fn_t)tdr_pull_vk_block,
                                           &vk)) {
-                                DEBUG(0, ("Unable to get VK block at %d\n",
+                                DEBUG(0, ("Unable to get VK block at 0x%x\n",
                                         tmp_vk_offset));
                                 return WERR_GENERAL_FAILURE;
@@ -1787 +1886 @@
                         }
                 }
-                /* Free data, if any */
-                if (!(vk.data_length & 0x80000000)) {
-                        hbin_free(regf, vk.data_offset);
-                }
-        }
+        }
+
+        /* If it's new, create the vk struct, if it's old, free the old data. */
         if (old_vk_offset == -1) {
                 vk.header = "vk";
@@ -1802 +1899 @@
                         vk.flag = 0;
                 }
-        }
+        } else {
+                /* Free data, if any */
+                if (!(vk.data_length & 0x80000000)) {
+                        hbin_free(regf, vk.data_offset);
+                }
+        }
+
         /* Set the type and data */
         vk.data_length = data.length;
         vk.data_type = type;
-        if (type == REG_DWORD) {
+        if ((type == REG_DWORD) || (type == REG_DWORD_BIG_ENDIAN)) {
+                if (vk.data_length != sizeof(uint32_t)) {
+                        DEBUG(0, ("DWORD or DWORD_BIG_ENDIAN value with size other than 4 byte!\n"));
+                        return WERR_NOT_SUPPORTED;
+                }
                 vk.data_length |= 0x80000000;
-                vk.data_offset = *(uint32_t *)data.data;
+                vk.data_offset = IVAL(data.data, 0);
         } else {
                 /* Store data somewhere */
@@ -1864 +1971 @@
                               (tdr_push_fn_t) tdr_push_nk_block,
                               private_data->offset, nk);
-        return regf_save_hbin(private_data->hive);
-}
-
-static WERROR regf_save_hbin(struct regf_data *regf)
-{
-        struct tdr_push *push = tdr_push_init(regf, regf->iconv_convenience);
-        int i;
+        return regf_save_hbin(private_data->hive, 0);
+}
+
+static WERROR regf_save_hbin(struct regf_data *regf, bool flush)
+{
+        struct tdr_push *push = tdr_push_init(regf);
+        unsigned int i;
 
         W_ERROR_HAVE_NO_MEMORY(push);
+
+        /* Only write once every 5 seconds, or when flush is set */
+        if (!flush && regf->last_write + 5 >= time(NULL)) {
+                return WERR_OK;
+        }
+
+        regf->last_write = time(NULL);
 
         if (lseek(regf->fd, 0, SEEK_SET) == -1) {
@@ -1887 +2001 @@
         talloc_free(push);
 
-        if (NT_STATUS_IS_ERR(tdr_push_to_fd(regf->fd, regf->iconv_convenience,
+        if (NT_STATUS_IS_ERR(tdr_push_to_fd(regf->fd,
                                             (tdr_push_fn_t)tdr_push_regf_hdr,
                                             regf->header))) {
@@ -1900 +2014 @@
 
         for (i = 0; regf->hbins[i]; i++) {
-                if (NT_STATUS_IS_ERR(tdr_push_to_fd(regf->fd, regf->iconv_convenience,
+                if (NT_STATUS_IS_ERR(tdr_push_to_fd(regf->fd, 
                                                     (tdr_push_fn_t)tdr_push_hbin_block,
                                                     regf->hbins[i]))) {
@@ -1912 +2026 @@
 
 WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, 
-                            struct smb_iconv_convenience *iconv_convenience,
                             const char *location,
                             int minor_version, struct hive_key **key)
@@ -1926 +2039 @@
 
         regf = (struct regf_data *)talloc_zero(NULL, struct regf_data);
-
-        regf->iconv_convenience = iconv_convenience;
 
         W_ERROR_HAVE_NO_MEMORY(regf);
@@ -1963 +2074 @@
 
         nk.header = "nk";
-        nk.type = REG_SUB_KEY;
+        nk.type = REG_ROOT_KEY;
         unix_to_nt_time(&nk.last_change, time(NULL));
         nk.uk1 = 0;
@@ -1997 +2108 @@
         
         /* Push the security descriptor to a blob */
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(&data, regf, NULL, 
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(&data, regf, 
                                      sd, (ndr_push_flags_fn_t)ndr_push_security_descriptor))) {
                 DEBUG(0, ("Unable to push security descriptor\n"));
@@ -2028 +2139 @@
                                                regf->header->data_offset);
 
-        error = regf_save_hbin(regf);
+        error = regf_save_hbin(regf, 1);
         if (!W_ERROR_IS_OK(error)) {
                 return error;
@@ -2034 +2145 @@
         
         /* We can drop our own reference now that *key will have created one */
-        talloc_free(regf);
+        talloc_unlink(NULL, regf);
 
         return WERR_OK;
 }
 
+static WERROR regf_flush_key(struct hive_key *key)
+{
+        struct regf_key_data *private_data = (struct regf_key_data *)key;
+        struct regf_data *regf = private_data->hive;
+        WERROR error;
+
+        error = regf_save_hbin(regf, 1);
+        if (!W_ERROR_IS_OK(error)) {
+                DEBUG(0, ("Failed to flush regf to disk\n"));
+                return error;
+        }
+
+        return WERR_OK;
+}
+
+static int regf_destruct(struct regf_data *regf)
+{
+        WERROR error;
+
+        /* Write to disk */
+        error = regf_save_hbin(regf, 1);
+        if (!W_ERROR_IS_OK(error)) {
+                DEBUG(0, ("Failed to flush registry to disk\n"));
+                return -1;
+        }
+
+        /* Close file descriptor */
+        close(regf->fd);
+
+        return 0;
+}
+
 WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx, const char *location, 
-                          struct smb_iconv_convenience *iconv_convenience, struct hive_key **key)
+                          struct hive_key **key)
 {
         struct regf_data *regf;
         struct regf_hdr *regf_hdr;
         struct tdr_pull *pull;
-        int i;
+        unsigned int i;
 
         regf = (struct regf_data *)talloc_zero(parent_ctx, struct regf_data);
-
-        regf->iconv_convenience = iconv_convenience;
-
         W_ERROR_HAVE_NO_MEMORY(regf);
+
+        talloc_set_destructor(regf, regf_destruct);
 
         DEBUG(5, ("Attempting to load registry file\n"));
@@ -2065 +2207 @@
         }
 
-        pull = tdr_pull_init(regf, regf->iconv_convenience);
+        pull = tdr_pull_init(regf);
 
         pull->data.data = (uint8_t*)fd_load(regf->fd, &pull->data.length, 0, regf);
@@ -2163 +2305 @@
         .del_key = regf_del_key,
         .delete_value = regf_del_value,
+        .flush_key = regf_flush_key
 };