first cut at implementing support for browsing printer and driver driver

via regedt32.exe.  The regsitry.tdb is only a framework.  It is not
intended to store values, only key/subkey structure.  The data
will be retrieved from nt*tdb (for printers) creating a virtual view
of the data.

You can currently connect to a Samba box using regedt32.exe (haven't
tried regedit.exe).  Some basic keys are created in registry.tdb
for use.

There are two problems....

  * something is getting freed in the winreg code that causes heap
    corruption later on.  As long as you don't play with the winreg
    server functionality, I don't think you'll be bitten by this.

  * no access controls are currently implemented

  * I can't browse HKLM because regedt32 greys out the SYSTEM subkey.

ok so that was three....
(This used to be commit 542d3c93a998083c07b2afa91a7c927c376caf54)

5 files changed, 802 insertions, 93 deletions

diff --git a/source3/include/rpc_reg.h b/source3/include/rpc_reg.h
index a5aa606120..3f3db0f2ba 100644
--- a/source3/include/rpc_reg.h
+++ b/source3/include/rpc_reg.h
@@ -24,34 +24,39 @@
 #define _RPC_REG_H 
 
 
-/* winreg pipe defines */
+/* winreg pipe defines 
+   NOT IMPLEMENTED !!
 #define REG_OPEN_HKCR		0x00
 #define _REG_UNK_01		0x01
-#define REG_OPEN_HKLM		0x02
 #define _REG_UNK_03		0x03
-#define REG_OPEN_HKU		0x04
-#define REG_CLOSE		0x05
 #define REG_CREATE_KEY		0x06
 #define REG_DELETE_KEY		0x07
 #define REG_DELETE_VALUE	0x08
-#define REG_ENUM_KEY		0x09
 #define REG_ENUM_VALUE		0x0a
 #define REG_FLUSH_KEY		0x0b
 #define REG_GET_KEY_SEC		0x0c
 #define	_REG_UNK_0D		0x0d
 #define _REG_UNK_0E		0x0e
-#define REG_OPEN_ENTRY		0x0f
-#define REG_QUERY_KEY		0x10
-#define REG_INFO		0x11
 #define	_REG_UNK_12		0x12
 #define _REG_UNK_13		0x13
 #define	_REG_UNK_14		0x14
 #define REG_SET_KEY_SEC		0x15
 #define REG_CREATE_VALUE	0x16
 #define	_REG_UNK_17		0x17
+*/
+
+/* Implemented */
+#define REG_OPEN_HKLM		0x02
+#define REG_OPEN_HKU		0x04
+#define REG_CLOSE		0x05
+#define REG_ENUM_KEY		0x09
+#define REG_OPEN_ENTRY		0x0f
+#define REG_QUERY_KEY		0x10
+#define REG_INFO		0x11
 #define REG_SHUTDOWN		0x18
 #define REG_ABORT_SHUTDOWN	0x19
-#define REG_UNK_1A		0x1a
+#define REG_UNKNOWN_1A		0x1a
+
 
 #define HKEY_CLASSES_ROOT	0x80000000
 #define HKEY_CURRENT_USER	0x80000001
@@ -121,17 +126,17 @@ REG_R_OPEN_HKLM;
 typedef struct q_reg_open_hku_info
 {
 	uint32 ptr;
-	uint16 unknown_0; /* 0xE084      - 16 bit unknown */
-	uint16 unknown_1; /* random.  changes */
-	uint32 level;     /* 0x0000 0002 - 32 bit unknown */
+	uint16 unknown_0; 
+	uint16 unknown_1; 
+	uint32 access_mask;    
 
 } REG_Q_OPEN_HKU;
 
 /* REG_R_OPEN_HKU */
 typedef struct r_reg_open_hku_info
 {
-	POLICY_HND pol;       /* policy handle */
-	NTSTATUS status;         /* return status */
+	POLICY_HND pol;      /* policy handle */
+	NTSTATUS status;     /* return status */
 
 } REG_R_OPEN_HKU;
 
@@ -355,7 +360,7 @@ typedef struct r_reg_query_key_info
 
 	uint32 num_subkeys;
 	uint32 max_subkeylen;
-	uint32 max_subkeysize; /* 0x0000 0000 */
+	uint32 reserved; /* 0x0000 0000 - according to MSDN (max_subkeysize?) */
 	uint32 num_values;
 	uint32 max_valnamelen;
 	uint32 max_valbufsize; 
@@ -367,20 +372,20 @@ typedef struct r_reg_query_key_info
 } REG_R_QUERY_KEY;
 
 
-/* REG_Q_UNK_1A */
+/* REG_Q_UNKNOWN_1A */
 typedef struct q_reg_unk_1a_info
 {
 	POLICY_HND pol;       /* policy handle */
 
-} REG_Q_UNK_1A;
+} REG_Q_UNKNOWN_1A;
 
-/* REG_R_UNK_1A */
+/* REG_R_UNKNOWN_1A */
 typedef struct r_reg_unk_1a_info
 {
 	uint32 unknown;         /* 0x0500 0000 */
 	NTSTATUS status;         /* return status */
 
-} REG_R_UNK_1A;
+} REG_R_UNKNOWN_1A;
 
 
 /* REG_Q_CLOSE */
@@ -498,7 +503,7 @@ typedef struct q_reg_open_entry_info
 	UNISTR2 uni_name;       /* unicode registry string name */
 
 	uint32 unknown_0;       /* 32 bit unknown - 0x0000 0000 */
-	uint32 unknown_1;       /* 32 bit unknown - 0x0200 0000 */
+	uint32 access_desired; 
 
 } REG_Q_OPEN_ENTRY;
 
diff --git a/source3/rpc_parse/parse_reg.c b/source3/rpc_parse/parse_reg.c
index 26d748657c..e1913990eb 100644
--- a/source3/rpc_parse/parse_reg.c
+++ b/source3/rpc_parse/parse_reg.c
@@ -571,7 +571,7 @@ BOOL reg_io_r_query_key(char *desc,  REG_R_QUERY_KEY *r_r, prs_struct *ps, int d
 		return False;
 	if(!prs_uint32("max_subkeylen ", ps, depth, &r_r->max_subkeylen))
 		return False;
-	if(!prs_uint32("mak_subkeysize", ps, depth, &r_r->max_subkeysize))
+	if(!prs_uint32("reserved      ", ps, depth, &r_r->reserved))
 		return False;
 	if(!prs_uint32("num_values    ", ps, depth, &r_r->num_values))
 		return False;
@@ -594,7 +594,7 @@ BOOL reg_io_r_query_key(char *desc,  REG_R_QUERY_KEY *r_r, prs_struct *ps, int d
  Inits a structure.
 ********************************************************************/
 
-void init_reg_q_unk_1a(REG_Q_UNK_1A *q_o, POLICY_HND *hnd)
+void init_reg_q_unknown_1a(REG_Q_UNKNOWN_1A *q_o, POLICY_HND *hnd)
 {
 	memcpy(&q_o->pol, hnd, sizeof(q_o->pol));
 }
@@ -603,12 +603,12 @@ void init_reg_q_unk_1a(REG_Q_UNK_1A *q_o, POLICY_HND *hnd)
 reads or writes a structure.
 ********************************************************************/
 
-BOOL reg_io_q_unk_1a(char *desc,  REG_Q_UNK_1A *r_q, prs_struct *ps, int depth)
+BOOL reg_io_q_unknown_1a(char *desc,  REG_Q_UNKNOWN_1A *r_q, prs_struct *ps, int depth)
 {
 	if (r_q == NULL)
 		return False;
 
-	prs_debug(ps, depth, desc, "reg_io_q_unk_1a");
+	prs_debug(ps, depth, desc, "reg_io_q_unknown_1a");
 	depth++;
 
 	if(!prs_align(ps))
@@ -624,12 +624,12 @@ BOOL reg_io_q_unk_1a(char *desc,  REG_Q_UNK_1A *r_q, prs_struct *ps, int depth)
 reads or writes a structure.
 ********************************************************************/
 
-BOOL reg_io_r_unk_1a(char *desc,  REG_R_UNK_1A *r_r, prs_struct *ps, int depth)
+BOOL reg_io_r_unknown_1a(char *desc,  REG_R_UNKNOWN_1A *r_r, prs_struct *ps, int depth)
 {
 	if (r_r == NULL)
 		return False;
 
-	prs_debug(ps, depth, desc, "reg_io_r_unk_1a");
+	prs_debug(ps, depth, desc, "reg_io_r_unknown_1a");
 	depth++;
 
 	if(!prs_align(ps))
@@ -648,12 +648,12 @@ BOOL reg_io_r_unk_1a(char *desc,  REG_R_UNK_1A *r_r, prs_struct *ps, int depth)
 ********************************************************************/
 
 void init_reg_q_open_hku(REG_Q_OPEN_HKU *q_o,
-				uint16 unknown_0, uint32 level)
+				uint16 unknown_0, uint32 access_mask)
 {
 	q_o->ptr = 1;
 	q_o->unknown_0 = unknown_0;
 	q_o->unknown_1 = 0x0; /* random - changes */
-	q_o->level = level;
+	q_o->access_mask = access_mask;
 }
 
 /*******************************************************************
@@ -674,11 +674,11 @@ BOOL reg_io_q_open_hku(char *desc,  REG_Q_OPEN_HKU *r_q, prs_struct *ps, int dep
 	if(!prs_uint32("ptr      ", ps, depth, &r_q->ptr))
 		return False;
 	if (r_q->ptr != 0) {
-		if(!prs_uint16("unknown_0", ps, depth, &r_q->unknown_0))
+		if(!prs_uint16("unknown_0   ", ps, depth, &r_q->unknown_0))
 			return False;
-		if(!prs_uint16("unknown_1", ps, depth, &r_q->unknown_1))
+		if(!prs_uint16("unknown_1   ", ps, depth, &r_q->unknown_1))
 			return False;
-		if(!prs_uint32("level    ", ps, depth, &r_q->level))
+		if(!prs_uint32("access_mask ", ps, depth, &r_q->access_mask))
 			return False;
 	}
 
@@ -729,7 +729,7 @@ BOOL reg_io_q_close(char *desc,  REG_Q_CLOSE *q_u, prs_struct *ps, int depth)
 	if (q_u == NULL)
 		return False;
 
-	prs_debug(ps, depth, desc, "reg_io_q_unknown_1");
+	prs_debug(ps, depth, desc, "reg_io_q_close");
 	depth++;
 
 	if(!prs_align(ps))
@@ -752,7 +752,7 @@ BOOL reg_io_r_close(char *desc,  REG_R_CLOSE *r_u, prs_struct *ps, int depth)
 	if (r_u == NULL)
 		return False;
 
-	prs_debug(ps, depth, desc, "reg_io_r_unknown_1");
+	prs_debug(ps, depth, desc, "reg_io_r_close");
 	depth++;
 
 	if(!prs_align(ps))
@@ -1354,6 +1354,29 @@ void init_reg_q_enum_key(REG_Q_ENUM_KEY *q_i, POLICY_HND *pol, uint32 key_idx)
 }
 
 /*******************************************************************
+makes a reply structure.
+********************************************************************/
+
+void init_reg_r_enum_key(REG_R_ENUM_KEY *r_u, char *subkey, uint32 unknown_1,
+			uint32 unknown_2)
+{
+	if ( !r_u )
+		return;
+		
+	r_u->unknown_1 = unknown_1;
+	r_u->unknown_2 = unknown_2;
+	r_u->unknown_3 = 0x0;
+	
+	r_u->key_name_len = (strlen(subkey)+1) * 2;
+	if (r_u->key_name_len)
+		r_u->ptr1 = 0x1;
+	init_unistr3( &r_u->key_name, subkey );
+	
+	r_u->ptr2 = 0x1;
+	r_u->ptr3 = 0x1;
+}
+
+/*******************************************************************
 reads or writes a structure.
 ********************************************************************/
 
@@ -1468,7 +1491,7 @@ makes a structure.
 ********************************************************************/
 
 void init_reg_q_open_entry(REG_Q_OPEN_ENTRY *r_q, POLICY_HND *pol,
-				char *key_name, uint32 unk)
+				char *key_name, uint32 access_desired)
 {
 	int len_name = strlen(key_name)+1;
 
@@ -1478,7 +1501,7 @@ void init_reg_q_open_entry(REG_Q_OPEN_ENTRY *r_q, POLICY_HND *pol,
 	init_unistr2(&r_q->uni_name, key_name, len_name);
 
 	r_q->unknown_0 = 0x00000000;
-	r_q->unknown_1 = unk;
+	r_q->access_desired = access_desired;
 }
 
 /*******************************************************************
@@ -1506,9 +1529,9 @@ BOOL reg_io_q_open_entry(char *desc,  REG_Q_OPEN_ENTRY *r_q, prs_struct *ps, int
 	if(!prs_align(ps))
 		return False;
 	
-	if(!prs_uint32("unknown_0", ps, depth, &r_q->unknown_0))
+	if(!prs_uint32("unknown_0        ", ps, depth, &r_q->unknown_0))
 		return False;
-	if(!prs_uint32("unknown_1", ps, depth, &r_q->unknown_1))
+	if(!prs_uint32("asccess_desired  ", ps, depth, &r_q->access_desired))
 		return False;
 
 	return True;
diff --git a/source3/rpc_server/srv_reg.c b/source3/rpc_server/srv_reg.c
index e024ba74e7..a096325860 100644
--- a/source3/rpc_server/srv_reg.c
+++ b/source3/rpc_server/srv_reg.c
@@ -1,11 +1,12 @@
-/* 
+/*
  *  Unix SMB/CIFS implementation.
  *  RPC Pipe client / server routines
  *  Copyright (C) Andrew Tridgell              1992-1997,
  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
  *  Copyright (C) Paul Ashton                       1997.
- *  Copyright (C) Marc Jacobsen						2000.
- *  Copyright (C) Jeremy Allison					2001.
+ *  Copyright (C) Marc Jacobsen	   		    2000.
+ *  Copyright (C) Jeremy Allison		    2001.
+ *  Copyright (C) Gerald Carter 		    2002.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -56,10 +57,10 @@ static BOOL api_reg_close(pipes_struct *p)
 }
 
 /*******************************************************************
- api_reg_open
+ api_reg_open_khlm
  ********************************************************************/
 
-static BOOL api_reg_open(pipes_struct *p)
+static BOOL api_reg_open_hklm(pipes_struct *p)
 {
 	REG_Q_OPEN_HKLM q_u;
 	REG_R_OPEN_HKLM r_u;
@@ -73,7 +74,7 @@ static BOOL api_reg_open(pipes_struct *p)
 	if(!reg_io_q_open_hklm("", &q_u, data, 0))
 		return False;
 
-	r_u.status = _reg_open(p, &q_u, &r_u);
+	r_u.status = _reg_open_hklm(p, &q_u, &r_u);
 
 	if(!reg_io_r_open_hklm("", &r_u, rdata, 0))
 		return False;
@@ -82,6 +83,33 @@ static BOOL api_reg_open(pipes_struct *p)
 }
 
 /*******************************************************************
+ api_reg_open_khlm
+ ********************************************************************/
+
+static BOOL api_reg_open_hku(pipes_struct *p)
+{
+	REG_Q_OPEN_HKU q_u;
+	REG_R_OPEN_HKU r_u;
+	prs_struct *data = &p->in_data.data;
+	prs_struct *rdata = &p->out_data.rdata;
+
+	ZERO_STRUCT(q_u);
+	ZERO_STRUCT(r_u);
+
+	/* grab the reg open */
+	if(!reg_io_q_open_hku("", &q_u, data, 0))
+		return False;
+
+	r_u.status = _reg_open_hku(p, &q_u, &r_u);
+
+	if(!reg_io_r_open_hku("", &r_u, rdata, 0))
+		return False;
+
+	return True;
+}
+
+
+/*******************************************************************
  api_reg_open_entry
  ********************************************************************/
 
@@ -188,17 +216,98 @@ static BOOL api_reg_abort_shutdown(pipes_struct *p)
 
 
 /*******************************************************************
+ api_reg_query_key
+ ********************************************************************/
+
+static BOOL api_reg_query_key(pipes_struct *p)
+{
+	REG_Q_QUERY_KEY q_u;
+	REG_R_QUERY_KEY r_u;
+	prs_struct *data = &p->in_data.data;
+	prs_struct *rdata = &p->out_data.rdata;
+
+	ZERO_STRUCT(q_u);
+	ZERO_STRUCT(r_u);
+
+	if(!reg_io_q_query_key("", &q_u, data, 0))
+		return False;
+
+	r_u.status = _reg_query_key(p, &q_u, &r_u);
+
+	if(!reg_io_r_query_key("", &r_u, rdata, 0))
+		return False;
+
+	return True;
+}
+
+/*******************************************************************
+ api_reg_unknown_1a
+ ********************************************************************/
+
+static BOOL api_reg_unknown_1a(pipes_struct *p)
+{
+	REG_Q_UNKNOWN_1A q_u;
+	REG_R_UNKNOWN_1A r_u;
+	prs_struct *data = &p->in_data.data;
+	prs_struct *rdata = &p->out_data.rdata;
+
+	ZERO_STRUCT(q_u);
+	ZERO_STRUCT(r_u);
+
+	if(!reg_io_q_unknown_1a("", &q_u, data, 0))
+		return False;
+
+	r_u.status = _reg_unknown_1a(p, &q_u, &r_u);
+
+	if(!reg_io_r_unknown_1a("", &r_u, rdata, 0))
+		return False;
+
+	return True;
+}
+
+/*******************************************************************
+ api_reg_enum_key
+ ********************************************************************/
+
+static BOOL api_reg_enum_key(pipes_struct *p)
+{
+	REG_Q_ENUM_KEY q_u;
+	REG_R_ENUM_KEY r_u;
+	prs_struct *data = &p->in_data.data;
+	prs_struct *rdata = &p->out_data.rdata;
+
+	ZERO_STRUCT(q_u);
+	ZERO_STRUCT(r_u);
+
+	if(!reg_io_q_enum_key("", &q_u, data, 0))
+		return False;
+
+	r_u.status = _reg_enum_key(p, &q_u, &r_u);
+
+	if(!reg_io_r_enum_key("", &r_u, rdata, 0))
+		return False;
+
+	return True;
+}
+
+
+
+/*******************************************************************
  array of \PIPE\reg operations
  ********************************************************************/
 static struct api_struct api_reg_cmds[] =
 {
-	{ "REG_CLOSE"        , REG_CLOSE        , api_reg_close        },
-	{ "REG_OPEN_ENTRY"   , REG_OPEN_ENTRY   , api_reg_open_entry   },
-	{ "REG_OPEN"         , REG_OPEN_HKLM    , api_reg_open         },
-	{ "REG_INFO"         , REG_INFO         , api_reg_info         },
-	{ "REG_SHUTDOWN"     , REG_SHUTDOWN     , api_reg_shutdown     },
-	{ "REG_ABORT_SHUTDOWN", REG_ABORT_SHUTDOWN, api_reg_abort_shutdown },
-	{ NULL,                0                , NULL                 }
+	{ "REG_CLOSE"              , REG_CLOSE              , api_reg_close            },
+	{ "REG_OPEN_ENTRY"         , REG_OPEN_ENTRY         , api_reg_open_entry       },
+	{ "REG_OPEN_HKLM"          , REG_OPEN_HKLM          , api_reg_open_hklm        },
+	{ "REG_OPEN_HKU"     	   , REG_OPEN_HKU           , api_reg_open_hku         },
+	{ "REG_ENUM_KEY"           , REG_ENUM_KEY           , api_reg_enum_key         },
+	{ "REG_QUERY_KEY"          , REG_QUERY_KEY          , api_reg_query_key        },
+	{ "REG_INFO"               , REG_INFO               , api_reg_info             },
+	{ "REG_SHUTDOWN"           , REG_SHUTDOWN           , api_reg_shutdown         },
+	{ "REG_ABORT_SHUTDOWN"     , REG_ABORT_SHUTDOWN     , api_reg_abort_shutdown   },
+	{ "REG_UNKNOWN_1A"         , REG_UNKNOWN_1A         , api_reg_unknown_1a       },
+	{ NULL                     , 0                      , NULL                     }
 };
 
 /*******************************************************************
diff --git a/source3/rpc_server/srv_reg_nt.c b/source3/rpc_server/srv_reg_nt.c
index 03aae14b53..0569d68cae 100644
--- a/source3/rpc_server/srv_reg_nt.c
+++ b/source3/rpc_server/srv_reg_nt.c
@@ -5,7 +5,8 @@
  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
  *  Copyright (C) Paul Ashton                       1997.
  *  Copyright (C) Hewlett-Packard Company           1999.
- *  Copyright (C) Jeremy Allison					2001.
+ *  Copyright (C) Jeremy Allison		    2001.
+ *  Copyright (C) Gerald Carter                     2002.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -29,20 +30,473 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_SRV
 
-struct reg_info {
-	/* for use by \PIPE\winreg */
+#define KEY_HKLM	"HKLM"
+#define KEY_HKU		"HKU"
+
+#define OUR_HANDLE(hnd) (((hnd)==NULL)?"NULL":(IVAL((hnd)->data5,4)==(uint32)sys_getpid()?"OURS":"OTHER")), \
+((unsigned int)IVAL((hnd)->data5,4)),((unsigned int)sys_getpid())
+
+/* structure to store the registry handles */
+
+typedef struct _RegistryKey {
+	struct _RegistryKey *prev, *next;
+
 	fstring name; /* name of registry key */
-};
+	POLICY_HND	hnd;
+	
+} Registry_Key;
+
+static Registry_Key *regkeys_list;
+static TDB_CONTEXT *tdb_reg;
+
+/***********************************************************************
+ Add subkey strings to the registry tdb under a defined key
+ fmt is the same format as tdb_pack except this function only supports
+ fstrings
+ ***********************************************************************/
+ 
+static BOOL store_reg_keys( TDB_CONTEXT *tdb, char *keyname, char **subkeys, uint32 num_subkeys  )
+{
+	TDB_DATA kbuf, dbuf;
+	void *buffer, *tmpbuf;
+	int i = 0;
+	uint32 len, buflen;
+	BOOL ret = True;
+	
+	if ( !keyname )
+		return False;
+	
+	/* allocate some initial memory */
+		
+	buffer = malloc(sizeof(pstring));
+	buflen = sizeof(pstring);
+	len = 0;
+	
+	/* store the number of subkeys */
+	
+	len += tdb_pack(buffer+len, buflen-len, "d", num_subkeys);
+	
+	/* pack all the strings */
+	
+	for (i=0; i<num_subkeys; i++) {
+		len += tdb_pack(buffer+len, buflen-len, "f", subkeys[i]);
+		if ( len > buflen ) {
+			/* allocate some extra space */
+			if ((tmpbuf = Realloc( buffer, len*2 )) == NULL) {
+				DEBUG(0,("store_reg_keys: Failed to realloc memory of size [%d]\n", len*2));
+				ret = False;
+				goto done;
+			}
+			buffer = tmpbuf;
+			buflen = len*2;
+					
+			len = tdb_pack(buffer+len, buflen-len, "f", subkeys[i]);
+		}		
+	}
+	
+	/* finally write out the data */
+	
+	kbuf.dptr = keyname;
+	kbuf.dsize = strlen(keyname)+1;
+	dbuf.dptr = buffer;
+	dbuf.dsize = len;
+	if ( tdb_store( tdb, kbuf, dbuf, TDB_REPLACE ) == -1) {
+		ret = False;
+		goto done;
+	}
+
+done:		
+	SAFE_FREE( buffer );
+	return ret;
+}
+
+/***********************************************************************
+ Retrieve an array of strings containing subkeys.  Memory should be 
+ released by the caller.  The subkeys are stored in a catenated string
+ of null terminated character strings
+ ***********************************************************************/
+
+static int fetch_reg_keys( TDB_CONTEXT *tdb,  char* key, char **subkeys )
+{
+	pstring path;
+	uint32 num_items;
+	TDB_DATA dbuf;
+	void *buf;
+	uint32 buflen, len;
+	int i;
+	char *s;
+
+	
+	pstrcpy( path, key );
+	
+	/* convert to key format */
+	pstring_sub( path, "\\", "/" );
+	
+	dbuf = tdb_fetch_by_string( tdb, path );
+	
+	buf = dbuf.dptr;
+	buflen = dbuf.dsize;
+	
+	if ( !buf ) {
+		DEBUG(5,("fetch_reg_keys: Failed to fetch any subkeys for [%s]\n", key));
+		return -1;
+	}
+	
+	len = tdb_unpack( buf, buflen, "d", &num_items);
+	if (num_items) {
+		if ( (*subkeys = (char*)malloc(sizeof(fstring)*num_items)) == NULL ) {
+			DEBUG(0,("fetch_reg_keys: Failed to malloc memory for subkey array containing [%d] items!\n",
+				num_items));
+			num_items = -1;
+			goto done;
+		}
+	}
+	
+	s = *subkeys;
+	for (i=0; i<num_items; i++) {
+		len += tdb_unpack( buf+len, buflen-len, "f", s );
+		s += strlen(s) + 1;
+	}
+
+done:	
+	SAFE_FREE(dbuf.dptr);
+	return num_items;
+}
+
+/***********************************************************************
+ count the number of subkeys dtored in the registry
+ ***********************************************************************/
+
+static int fetch_reg_keys_count( TDB_CONTEXT *tdb,  char* key )
+{
+	pstring path;
+	uint32 num_items;
+	TDB_DATA dbuf;
+	void *buf;
+	uint32 buflen, len;
+	
+	
+	pstrcpy( path, key );
+	
+	/* convert to key format */
+	pstring_sub( path, "\\", "/" );
+	
+	dbuf = tdb_fetch_by_string( tdb, path );
+	
+	buf = dbuf.dptr;
+	buflen = dbuf.dsize;
+	
+	if ( !buf ) {
+		DEBUG(5,("fetch_reg_keys: Failed to fetch any subkeys for [%s]\n", key));
+		return -1;
+	}
+	
+	len = tdb_unpack( buf, buflen, "d", &num_items);
+	
+	SAFE_FREE( buf );
+	
+	return num_items;
+}
 
+/***********************************************************************
+ retreive a specific subkey specified by index.  The subkey parameter
+ is assumed to be an fstring.
+ ***********************************************************************/
+
+static BOOL fetch_reg_keys_specific( TDB_CONTEXT *tdb,  char* key, char* subkey, uint32 index )
+{
+	int num_subkeys, i;
+	char *subkeys = NULL;
+	char *s;
+	
+	num_subkeys = fetch_reg_keys( tdb_reg, key, &subkeys );
+	if ( num_subkeys == -1 )
+		return False;
+
+	s = subkeys;
+	for ( i=0; i<num_subkeys; i++ ) {
+		/* copy the key if the index matches */
+		if ( i == index ) {
+			fstrcpy( subkey, s );
+			break;
+		}
+		
+		/* go onto the next string */
+		s += strlen(s) + 1;
+	}
+	
+	SAFE_FREE(subkeys);
+	
+	return True;
+}
+
+
+/***********************************************************************
+ Open the registry database
+ ***********************************************************************/
+ 
+static BOOL init_registry_data( TDB_CONTEXT* tdb_reg )
+{
+	pstring keyname;
+	char *subkeys[3];
+
+	/* HKEY_LOCAL_MACHINE */
+	
+	pstrcpy( keyname, KEY_HKLM );
+	subkeys[0] = "SYSTEM";
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 1 ))
+		return False;
+		
+	pstrcpy( keyname, KEY_HKLM );
+	pstrcat( keyname, "/SYSTEM" );
+	subkeys[0] = "CurrentControlSet";
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 1 ))
+		return False;
+		
+	pstrcpy( keyname, KEY_HKLM );
+	pstrcat( keyname, "/SYSTEM/CurrentControlSet" );
+	subkeys[0] = "Control";
+	subkeys[1] = "services";
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 2 ))
+		return False;
+
+	pstrcpy( keyname, KEY_HKLM );
+	pstrcat( keyname, "/SYSTEM/CurrentControlSet/Control" );
+	subkeys[0] = "Print";
+	subkeys[1] = "ProduceOptions";
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 2 ))
+		return False;
+
+	pstrcpy( keyname, KEY_HKLM );
+	pstrcat( keyname, "/SYSTEM/CurrentControlSet/Control/Print" );
+	subkeys[0] = "Environments";
+	subkeys[1] = "Forms";
+	subkeys[2] = "Printers";
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 3 ))
+		return False;
+
+	pstrcpy( keyname, KEY_HKLM );
+	pstrcat( keyname, "/SYSTEM/CurrentControlSet/Control/ProductOptions" );
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 0 ))
+		return False;
+
+	pstrcpy( keyname, KEY_HKLM );
+	pstrcat( keyname, "/SYSTEM/CurrentControlSet/services" );
+	subkeys[0] = "Netlogon";
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 1 ))
+		return False;
+		
+	pstrcpy( keyname, KEY_HKLM );
+	pstrcat( keyname, "/SYSTEM/CurrentControlSet/services/Netlogon" );
+	subkeys[0] = "parameters";
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 1 ))
+		return False;
+		
+	pstrcpy( keyname, KEY_HKLM );
+	pstrcat( keyname, "/SYSTEM/CurrentControlSet/services/Netlogon/parameters" );
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 0 ))
+		return False;
+
+	
+	/* HKEY_USER */
+		
+	pstrcpy( keyname, KEY_HKU );
+	if ( !store_reg_keys( tdb_reg, keyname, subkeys, 0 ) )
+		return False;
+		
+	return True;
+}
+  
+/***********************************************************************
+ Open the registry database
+ ***********************************************************************/
+ 
+BOOL init_registry( void )
+{
+	static pid_t local_pid;
+	
+	
+	if (tdb_reg && local_pid == sys_getpid())
+		return True;
+
+	/* 
+	 * try to open first without creating so we can determine
+	 * if we need to init the data in the registry
+	 */
+	
+	tdb_reg = tdb_open_log(lock_path("registry.tdb"), 0, TDB_DEFAULT, O_RDWR, 0600);
+	if ( !tdb_reg ) 
+	{
+		tdb_reg = tdb_open_log(lock_path("registry.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
+		if ( !tdb_reg ) {
+			DEBUG(0,("init_registry: Failed to open registry %s (%s)\n",
+				lock_path("registry.tdb"), strerror(errno) ));
+			return False;
+		}
+		
+		DEBUG(10,("init_registry: Successfully created registry tdb\n"));
+		
+		/* create the registry here */
+		if ( !init_registry_data( tdb_reg ) ) {
+			DEBUG(0,("init_registry: Failed to initiailize data in registry!\n"));
+			return False;
+		}
+	}
+
+	local_pid = sys_getpid();
+	
+	return True;
+}
+
+/******************************************************************
+ Find a registry key handle and return a Registry_Key
+ *****************************************************************/
+
+static Registry_Key *find_regkey_index_by_hnd(pipes_struct *p, POLICY_HND *hnd)
+{
+	Registry_Key *regkey = NULL;
+
+	if(!find_policy_by_hnd(p,hnd,(void **)&regkey)) {
+		DEBUG(2,("find_regkey_index_by_hnd: Registry Key not found: "));
+		return NULL;
+	}
+
+	return regkey;
+}
+
+
+/******************************************************************
+ free() function for Registry_Key
+ *****************************************************************/
+ 
 static void free_reg_info(void *ptr)
 {
-	struct reg_info *info = (struct reg_info *)ptr;
+	Registry_Key *info = (Registry_Key*)ptr;
 
 	SAFE_FREE(info);
 }
 
 /*******************************************************************
- reg_reply_unknown_1
+ Function for open a new registry handle and creating a handle 
+ Note that P should be valid & hnd should already have space
+ *******************************************************************/
+ 
+static BOOL open_registry_key(pipes_struct *p, POLICY_HND *hnd, char *name, 
+				uint32 access_granted)
+{
+	Registry_Key *regkey = NULL;
+
+	DEBUG(7,("open_registry_key: name = [%s]\n", name));
+
+	/* All registry keys **must** have a name of non-zero length */
+	
+	if (!name || !*name )
+		return False;
+			
+	if ((regkey=(Registry_Key*)malloc(sizeof(Registry_Key))) == NULL)
+		return False;
+		
+	ZERO_STRUCTP( regkey );
+	
+	DLIST_ADD( regkeys_list, regkey );
+
+	/* copy the name and obtain a handle */
+	
+	fstrcpy( regkey->name, name );
+	
+	DEBUG(7,("open_registry_key: exit\n"));
+	
+	return create_policy_hnd( p, hnd, free_reg_info, regkey );
+}
+
+/*******************************************************************
+ Function for open a new registry handle and creating a handle 
+ Note that P should be valid & hnd should already have space
+ *******************************************************************/
+
+static BOOL close_registry_key(pipes_struct *p, POLICY_HND *hnd)
+{
+	Registry_Key *regkey = find_regkey_index_by_hnd(p, hnd);
+	
+	if ( !regkey ) {
+		DEBUG(2,("close_registry_key: Invalid handle (%s:%u:%u)\n", OUR_HANDLE(hnd)));
+		return False;
+	}
+	
+	close_policy_hnd(p, hnd);
+	
+	return True;
+}
+
+/********************************************************************
+ retrieve information about the subkeys
+ *******************************************************************/
+ 
+static BOOL get_subkey_information( Registry_Key *key, uint32 *maxnum, uint32 *maxlen )
+{
+	int num_subkeys, i;
+	uint32 max_len;
+	char *subkeys = NULL;
+	uint32 len;
+	char *s;
+	
+	if ( !key )
+		return False;
+	
+	num_subkeys = fetch_reg_keys( tdb_reg, key->name, &subkeys );
+	if ( num_subkeys == -1 )
+		return False;
+
+	/* find the longest string */
+	
+	max_len = 0;
+	s = subkeys;
+	for ( i=0; i<num_subkeys; i++ ) {
+		len = strlen(s);
+		max_len = MAX(max_len, len);
+		s += len + 1;
+	}
+
+	*maxnum = num_subkeys;
+	*maxlen = max_len*2;
+	
+	SAFE_FREE(subkeys);
+	
+	return True;
+}
+
+/********************************************************************
+ retrieve information about the values.  We don't store values 
+ here.  The registry tdb is intended to be a frontend to oether 
+ Samba tdb's (such as ntdrivers.tdb).
+ *******************************************************************/
+ 
+static BOOL get_value_information( Registry_Key *key, uint32 *maxnum, 
+                                    uint32 *maxlen, uint32 *maxsize )
+{
+	if ( !key )
+		return False;
+
+	/* Hard coded key names first */
+	
+	if ( !strcmp(key->name, KEY_HKLM) || !strcmp(key->name, KEY_HKU) )
+	{
+		*maxnum   = 0;
+		*maxlen   = 0;
+		*maxsize  = 0;
+		return True;
+	}
+	
+	/* 
+	 * FIXME!!! Need to add routines to look up values in other
+	 * databases   --jerry
+	 */
+
+	return False;
+}
+
+/********************************************************************
+ reg_close
  ********************************************************************/
 
 NTSTATUS _reg_close(pipes_struct *p, REG_Q_CLOSE *q_u, REG_R_CLOSE *r_u)
@@ -51,7 +505,7 @@ NTSTATUS _reg_close(pipes_struct *p, REG_Q_CLOSE *q_u, REG_R_CLOSE *r_u)
 	ZERO_STRUCT(r_u->pol);
 
 	/* close the policy handle */
-	if (!close_policy_hnd(p, &q_u->pol))
+	if (!close_registry_key(p, &q_u->pol))
 		return NT_STATUS_OBJECT_NAME_INVALID;
 
 	return NT_STATUS_OK;
@@ -61,9 +515,21 @@ NTSTATUS _reg_close(pipes_struct *p, REG_Q_CLOSE *q_u, REG_R_CLOSE *r_u)
  reg_reply_open
  ********************************************************************/
 
-NTSTATUS _reg_open(pipes_struct *p, REG_Q_OPEN_HKLM *q_u, REG_R_OPEN_HKLM *r_u)
+NTSTATUS _reg_open_hklm(pipes_struct *p, REG_Q_OPEN_HKLM *q_u, REG_R_OPEN_HKLM *r_u)
+{
+	if (!open_registry_key(p, &r_u->pol, KEY_HKLM, 0x0))
+		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+
+	return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ reg_reply_open
+ ********************************************************************/
+
+NTSTATUS _reg_open_hku(pipes_struct *p, REG_Q_OPEN_HKU *q_u, REG_R_OPEN_HKU *r_u)
 {
-	if (!create_policy_hnd(p, &r_u->pol, free_reg_info, NULL))
+	if (!open_registry_key(p, &r_u->pol, KEY_HKU, 0x0))
 		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 
 	return NT_STATUS_OK;
@@ -77,34 +543,36 @@ NTSTATUS _reg_open_entry(pipes_struct *p, REG_Q_OPEN_ENTRY *q_u, REG_R_OPEN_ENTR
 {
 	POLICY_HND pol;
 	fstring name;
-	struct reg_info *info = NULL;
+	pstring path;
+	int num_subkeys;
+	Registry_Key *key = find_regkey_index_by_hnd(p, &q_u->pol);
 
-	DEBUG(5,("reg_open_entry: %d\n", __LINE__));
+	DEBUG(5,("reg_open_entry: Enter\n"));
 
-	if (!find_policy_by_hnd(p, &q_u->pol, NULL))
+	if ( !key )
 		return NT_STATUS_INVALID_HANDLE;
 
 	rpcstr_pull(name,q_u->uni_name.buffer,sizeof(name),q_u->uni_name.uni_str_len*2,0);
 
-	DEBUG(5,("reg_open_entry: %s\n", name));
-
-	/* lkcl XXXX do a check on the name, here */
-	if (!strequal(name, "SYSTEM\\CurrentControlSet\\Control\\ProductOptions") &&
-	    !strequal(name, "System\\CurrentControlSet\\services\\Netlogon\\parameters\\"))
-			return NT_STATUS_ACCESS_DENIED;
+	/* store the full path in the regkey_list */
+	
+	pstrcpy( path, key->name );
+	pstrcat( path, "\\" );
+	pstrcat( path, name );
 
-	if ((info = (struct reg_info *)malloc(sizeof(struct reg_info))) == NULL)
-		return NT_STATUS_NO_MEMORY;
+	DEBUG(5,("reg_open_entry: %s\n", path));
 
-	ZERO_STRUCTP(info);
-	fstrcpy(info->name, name);
+	/* do a check on the name, here */
+	
+	if ( (num_subkeys=fetch_reg_keys_count( tdb_reg, path )) == -1 )
+		return NT_STATUS_ACCESS_DENIED;
 
-	if (!create_policy_hnd(p, &pol, free_reg_info, (void *)info))
-		return NT_STATUS_TOO_MANY_SECRETS; /* ha ha very droll */
+	if (!open_registry_key(p, &pol, path, 0x0))
+		return NT_STATUS_TOO_MANY_SECRETS; 
 
 	init_reg_r_open_entry(r_u, &pol, NT_STATUS_OK);
 
-	DEBUG(5,("reg_open_entry: %d\n", __LINE__));
+	DEBUG(5,("reg_open_entry: Exitn"));
 
 	return r_u->status;
 }
@@ -116,21 +584,23 @@ NTSTATUS _reg_open_entry(pipes_struct *p, REG_Q_OPEN_ENTRY *q_u, REG_R_OPEN_ENTR
 NTSTATUS _reg_info(pipes_struct *p, REG_Q_INFO *q_u, REG_R_INFO *r_u)
 {
 	NTSTATUS status = NT_STATUS_OK;
-	char *key = NULL;
-	uint32 type=0x1; /* key type: REG_SZ */
-
+	char *value = NULL;
+	uint32 type = 0x1; /* key type: REG_SZ */
 	UNISTR2 *uni_key = NULL;
 	BUFFER2 *buf = NULL;
 	fstring name;
+	Registry_Key *key = find_regkey_index_by_hnd( p, &q_u->pol );
 
-	DEBUG(5,("_reg_info: %d\n", __LINE__));
+	DEBUG(5,("_reg_info: Enter\n"));
 
-	if (!find_policy_by_hnd(p, &q_u->pol, NULL))
+	if ( !key )
 		return NT_STATUS_INVALID_HANDLE;
+		
+	DEBUG(7,("_reg_info: policy key name = [%s]\n", key->name));
 
 	rpcstr_pull(name, q_u->uni_type.buffer, sizeof(name), q_u->uni_type.uni_str_len*2, 0);
 
-	DEBUG(5,("reg_info: checking key: %s\n", name));
+	DEBUG(5,("reg_info: checking subkey: %s\n", name));
 
 	uni_key = (UNISTR2 *)talloc_zero(p->mem_ctx, sizeof(UNISTR2));
 	buf = (BUFFER2 *)talloc_zero(p->mem_ctx, sizeof(BUFFER2));
@@ -150,33 +620,126 @@ NTSTATUS _reg_info(pipes_struct *p, REG_Q_INFO *q_u, REG_R_INFO *r_u)
 	}
 
 	switch (lp_server_role()) {
-	case ROLE_DOMAIN_PDC:
-	case ROLE_DOMAIN_BDC:
-		key = "LanmanNT";
-		break;
-	case ROLE_STANDALONE:
-		key = "ServerNT";
-		break;
-	case ROLE_DOMAIN_MEMBER:
-		key = "WinNT";
-		break;
+		case ROLE_DOMAIN_PDC:
+		case ROLE_DOMAIN_BDC:
+			value = "LanmanNT";
+			break;
+		case ROLE_STANDALONE:
+			value = "ServerNT";
+			break;
+		case ROLE_DOMAIN_MEMBER:
+			value = "WinNT";
+			break;
 	}
 
 	/* This makes the server look like a member server to clients */
 	/* which tells clients that we have our own local user and    */
 	/* group databases and helps with ACL support.                */
 
-	init_unistr2(uni_key, key, strlen(key)+1);
+	init_unistr2(uni_key, value, strlen(value)+1);
 	init_buffer2(buf, (uint8*)uni_key->buffer, uni_key->uni_str_len*2);
   
  out:
 	init_reg_r_info(q_u->ptr_buf, r_u, buf, type, status);
 
-	DEBUG(5,("reg_open_entry: %d\n", __LINE__));
+	DEBUG(5,("reg_open_entry: Exit\n"));
+
+	return status;
+}
+
+
+/*****************************************************************************
+ Implementation of REG_QUERY_KEY
+ ****************************************************************************/
+ 
+NTSTATUS _reg_query_key(pipes_struct *p, REG_Q_QUERY_KEY *q_u, REG_R_QUERY_KEY *r_u)
+{
+	NTSTATUS 	status = NT_STATUS_OK;
+	Registry_Key	*regkey = find_regkey_index_by_hnd( p, &q_u->pol );
+	
+	DEBUG(5,("_reg_query_key: Enter\n"));
+	
+	if ( !regkey )
+		return NT_STATUS_INVALID_HANDLE;	
+	
+	if ( !get_subkey_information( regkey, &r_u->num_subkeys, &r_u->max_subkeylen ) )
+		return NT_STATUS_ACCESS_DENIED;
+		
+	if ( !get_value_information( regkey, &r_u->num_values, &r_u->max_valnamelen, &r_u->max_valbufsize ) )
+		return NT_STATUS_ACCESS_DENIED;	
+		
+	r_u->sec_desc = 0x0;	/* size for key's sec_desc */
+	
+	/* Win9x set this to 0x0 since it does not keep timestamps.
+	   Doing the same here for simplicity   --jerry */
+	   
+	ZERO_STRUCT(r_u->mod_time);	
+
+	DEBUG(5,("_reg_query_key: Exit\n"));
+	
+	return status;
+}
+
+
+/*****************************************************************************
+ Implementation of REG_UNKNOWN_1A
+ ****************************************************************************/
+ 
+NTSTATUS _reg_unknown_1a(pipes_struct *p, REG_Q_UNKNOWN_1A *q_u, REG_R_UNKNOWN_1A *r_u)
+{
+	NTSTATUS 	status = NT_STATUS_OK;
+	Registry_Key	*regkey = find_regkey_index_by_hnd( p, &q_u->pol );
+	
+	DEBUG(5,("_reg_unknown_1a: Enter\n"));
+	
+	if ( !regkey )
+		return NT_STATUS_INVALID_HANDLE;	
+	
+	r_u->unknown = 0x05000000;	/* seems to be consistent...no idea what it means */
+	
+	DEBUG(5,("_reg_unknown_1a: Exit\n"));
+	
+	return status;
+}
+
 
+/*****************************************************************************
+ Implementation of REG_ENUM_KEY
+ ****************************************************************************/
+ 
+NTSTATUS _reg_enum_key(pipes_struct *p, REG_Q_ENUM_KEY *q_u, REG_R_ENUM_KEY *r_u)
+{
+	NTSTATUS 	status = NT_STATUS_OK;
+	Registry_Key	*regkey = find_regkey_index_by_hnd( p, &q_u->pol );
+	fstring		subkey;
+	
+	
+	DEBUG(5,("_reg_enum_key: Enter\n"));
+	
+	if ( !regkey )
+		return NT_STATUS_INVALID_HANDLE;	
+
+	DEBUG(8,("_reg_enum_key: enumerating key [%s]\n", regkey->name));
+	
+	if ( !fetch_reg_keys_specific( tdb_reg, regkey->name, subkey, q_u->key_index ) )
+	{
+		status = werror_to_ntstatus( WERR_NO_MORE_ITEMS );
+		goto done;
+	}
+	
+	DEBUG(10,("_reg_enum_key: retrieved subkey named [%s]\n", subkey));
+	
+	/* subkey has the string name now */
+	
+	init_reg_r_enum_key( r_u, subkey, q_u->unknown_1, q_u->unknown_2 );
+	
+	DEBUG(5,("_reg_enum_key: Exit\n"));
+	
+done:	
 	return status;
 }
 
+
 /*******************************************************************
  reg_shutdwon
  ********************************************************************/
@@ -222,6 +785,10 @@ NTSTATUS _reg_shutdown(pipes_struct *p, REG_Q_SHUTDOWN *q_u, REG_R_SHUTDOWN *r_u
 	return status;
 }
 
+/*******************************************************************
+ reg_abort_shutdwon
+ ********************************************************************/
+
 NTSTATUS _reg_abort_shutdown(pipes_struct *p, REG_Q_ABORT_SHUTDOWN *q_u, REG_R_ABORT_SHUTDOWN *r_u)
 {
 	NTSTATUS status = NT_STATUS_OK;
@@ -237,3 +804,5 @@ NTSTATUS _reg_abort_shutdown(pipes_struct *p, REG_Q_ABORT_SHUTDOWN *q_u, REG_R_A
 
 	return status;
 }
+
+
diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index 7d2c62d839..e1e6513659 100644
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -853,6 +853,9 @@ static void usage(char *pname)
 	if (!share_info_db_init())
 		exit(1);
 
+	if (!init_registry())
+		exit(1);
+
 	if(!initialize_password_db(False))
 		exit(1);