When Windows attempts to create a new key, it looks for an available key name

starting with "New Key #1" and iterating up to "New Key #99" before giving up.
ldb_open_key() calls reg_path_to_ldb() to build the appropriate dn from the key
name.  reg_path_to_ldb() was not catching the error returned by
ldb_dn_add_base_fmt() due to the unescaped '#' character, causing the returned
dn to be that of the parent key, not the potential new key.  Additionally,
Windows expects a return value of WERR_BADFILE when a key does not exist, but
WERR_NOT_FOUND was being returned instead.  Correcting the building of the dn
and the providing the expected return value allows new key creation to succeed.

When attempting to delete a key, Windows passes the complete path to the key,
not just the name of the child key to be deleted.  Using reg_path_to_ldb() to
build the correct dn allows key deletion to succeed.
(This used to be commit d57792d67b865ef43e7f21640b158862627f4b45)

1 files changed, 7 insertions, 0 deletions

diff --git a/source4/rpc_server/winreg/rpc_winreg.c b/source4/rpc_server/winreg/rpc_winreg.c
index 681e3b918f..3c00944d59 100644
--- a/source4/rpc_server/winreg/rpc_winreg.c
+++ b/source4/rpc_server/winreg/rpc_winreg.c
@@ -356,6 +356,13 @@ static WERROR dcesrv_winreg_OpenKey(struct dcesrv_call_state *dce_call,
 		r->out.handle = &newh->wire_handle;
 	} else {
 		talloc_free(newh);
+		/*
+		 * Windows expects WERR_BADFILE when a particular key
+		 * is not found.  If we receive WERR_NOT_FOUND from the lower
+		 * layer calls, translate it here to return what is expected.
+		 */
+		if (W_ERROR_EQUAL(result, WERR_NOT_FOUND))
+			return WERR_BADFILE;
 	}
 
 	return result;