Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-gmake3

Conflicts:

	source/Makefile
	source/build/smb_build/makefile.pm
	source/librpc/config.mk
(This used to be commit 3e02fcfd3fb6683f51417ba39f4ec177494eff3e)

3 files changed, 300 insertions, 122 deletions

diff --git a/source4/torture/raw/chkpath.c b/source4/torture/raw/chkpath.c
index 42a3c3cebe..fa69c92caa 100644
--- a/source4/torture/raw/chkpath.c
+++ b/source4/torture/raw/chkpath.c
@@ -54,24 +54,68 @@ static NTSTATUS single_search(struct smbcli_state *cli,
 	return status;
 }
 
-static bool test_path(struct smbcli_state *cli, const char *path, NTSTATUS expected, NTSTATUS dos_expected)
+static bool test_path_ex(struct smbcli_state *cli, struct torture_context *tctx,
+			 const char *path, const char *path_expected,
+			 NTSTATUS expected, NTSTATUS dos_expected)
 {
 	union smb_chkpath io;
+	union smb_fileinfo finfo;
 	NTSTATUS status;
+
 	io.chkpath.in.path = path;
 	status = smb_raw_chkpath(cli->tree, &io);
 	if (!NT_STATUS_EQUAL(status, expected) && !NT_STATUS_EQUAL(status, dos_expected)) {
-		printf("%-40s FAILED %s should be %s or %s\n", 
+		printf("FAILED %-30s chkpath %s should be %s or %s\n",
 		       path, nt_errstr(status), nt_errstr(expected), nt_errstr(dos_expected));
 		return false;
 	} else {
-		printf("%-40s correct (%s)\n", path, nt_errstr(status));
+		printf("%-30s chkpath correct (%s)\n", path, nt_errstr(status));
+	}
+
+	if (NT_STATUS_EQUAL(expected, NT_STATUS_NOT_A_DIRECTORY)) {
+		expected = NT_STATUS_OK;
+	}
+
+	ZERO_STRUCT(finfo);
+	finfo.generic.level = RAW_FILEINFO_NAME_INFO;
+	finfo.generic.in.file.path = path;
+	status = smb_raw_pathinfo(cli->tree, cli, &finfo);
+	if (!NT_STATUS_EQUAL(status, expected) && !NT_STATUS_EQUAL(status, dos_expected)) {
+		printf("FAILED: %-30s pathinfo %s should be %s or %s\n",
+		       path, nt_errstr(status), nt_errstr(expected), nt_errstr(dos_expected));
+		return false;
+	}
+
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("%-30s chkpath correct (%s)\n", path, nt_errstr(status));
+		return true;
+	}
 
+	if (path_expected &&
+	    (!finfo.name_info.out.fname.s ||
+	     strcmp(finfo.name_info.out.fname.s, path_expected) != 0)) {
+		if (tctx && torture_setting_bool(tctx, "samba4", false)) {
+			printf("IGNORE: %-30s => %-20s should be %s\n",
+				path, finfo.name_info.out.fname.s, path_expected);
+			return true;
+		}
+		printf("FAILED: %-30s => %-20s should be %s\n",
+			path, finfo.name_info.out.fname.s, path_expected);
+		return false;
 	}
+	printf("%-30s => %-20s correct\n",
+		path, finfo.name_info.out.fname.s);
+
 	return true;
 }
 
-static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
+static bool test_path(struct smbcli_state *cli, const char *path,
+		      NTSTATUS expected, NTSTATUS dos_expected)
+{
+	return test_path_ex(cli, NULL, path, path, expected, dos_expected);
+}
+
+static bool test_chkpath(struct smbcli_state *cli, struct torture_context *tctx)
 {
 	union smb_chkpath io;
 	NTSTATUS status;
@@ -86,7 +130,7 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 
 	ret &= test_path(cli, BASEDIR "\\nodir", NT_STATUS_OBJECT_NAME_NOT_FOUND, NT_STATUS_DOS(ERRDOS,ERRbadpath));
 
-	fnum = create_complex_file(cli, mem_ctx, BASEDIR "\\test.txt..");
+	fnum = create_complex_file(cli, tctx, BASEDIR "\\test.txt..");
 	if (fnum == -1) {
 		printf("failed to open test.txt - %s\n", smbcli_errstr(cli->tree));
 		ret = false;
@@ -101,9 +145,20 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 		goto done;
 	}
 
-	ret &= test_path(cli, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
-	ret &= test_path(cli, BASEDIR "\\foo\\..\\test.txt..", NT_STATUS_NOT_A_DIRECTORY, NT_STATUS_DOS(ERRDOS,ERRbadpath));
-	ret &= test_path(cli, "", NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR) + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR"\\\\") + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR"\\foo\\..") + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR"\\f\\o\\o\\..\\..\\..") + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR"\\foo\\\\\..\\\\") + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR"\\", BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR"\\\\..\\"BASEDIR, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR"\\\\\\", BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, "\\\\\\\\"BASEDIR"\\\\\\\\", BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, "\\\\\\\\"BASEDIR, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR "\\foo\\..\\test.txt..", BASEDIR "\\test.txt..",
+			    NT_STATUS_NOT_A_DIRECTORY, NT_STATUS_DOS(ERRDOS,ERRbadpath));
+	ret &= test_path_ex(cli, tctx, "", "\\", NT_STATUS_OK, NT_STATUS_OK);
 	ret &= test_path(cli, ".", NT_STATUS_OBJECT_NAME_INVALID, NT_STATUS_DOS(ERRDOS,ERRbadpath));
 	ret &= test_path(cli, ".\\", NT_STATUS_OBJECT_NAME_INVALID, NT_STATUS_DOS(ERRDOS,ERRbadpath));
 	ret &= test_path(cli, "\\\\\\.\\", NT_STATUS_OBJECT_NAME_INVALID, NT_STATUS_DOS(ERRDOS,ERRbadpath));
@@ -122,7 +177,7 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	  give different NT status returns for chkpth and findfirst. */
 
 	printf("testing findfirst on %s\n", "\\.\\\\\\\\\\\\.");
-	status = single_search(cli, mem_ctx, "\\.\\\\\\\\\\\\.");
+	status = single_search(cli, tctx, "\\.\\\\\\\\\\\\.");
 	CHECK_STATUS(status, NT_STATUS_OBJECT_NAME_INVALID,NT_STATUS_DOS(ERRDOS,ERRinvalidname));
 
 	ret &= test_path(cli, "\\.\\\\\\\\\\\\.", NT_STATUS_OBJECT_PATH_NOT_FOUND,NT_STATUS_DOS(ERRDOS,ERRbadpath));
@@ -164,7 +219,7 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	ret &= test_path(cli, "\\..\\", NT_STATUS_OBJECT_PATH_SYNTAX_BAD,NT_STATUS_DOS(ERRDOS,ERRinvalidpath));
 	ret &= test_path(cli, "\\..", NT_STATUS_OBJECT_PATH_SYNTAX_BAD,NT_STATUS_DOS(ERRDOS,ERRinvalidpath));
 	ret &= test_path(cli, BASEDIR "\\.", NT_STATUS_OBJECT_NAME_INVALID,NT_STATUS_DOS(ERRDOS,ERRbadpath));
-	ret &= test_path(cli, BASEDIR "\\..", NT_STATUS_OK,NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR "\\..", "\\", NT_STATUS_OK,NT_STATUS_OK);
 	ret &= test_path(cli, BASEDIR "\\nt\\V S\\VB98\\vb600", NT_STATUS_OBJECT_NAME_NOT_FOUND,NT_STATUS_DOS(ERRDOS,ERRbadpath));
 	ret &= test_path(cli, BASEDIR "\\nt\\V S\\VB98\\vb6.exe", NT_STATUS_NOT_A_DIRECTORY,NT_STATUS_DOS(ERRDOS,ERRbadpath));
 
@@ -183,7 +238,7 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	CHECK_STATUS(status, NT_STATUS_OBJECT_PATH_NOT_FOUND,NT_STATUS_DOS(ERRDOS,ERRbadpath));
 
 	printf("testing findfirst on %s\n", BASEDIR".\\.\\.\\.\\foo\\..\\.\\");
-	status = single_search(cli, mem_ctx, BASEDIR".\\.\\.\\.\\foo\\..\\.\\");
+	status = single_search(cli, tctx, BASEDIR".\\.\\.\\.\\foo\\..\\.\\");
 	CHECK_STATUS(status, NT_STATUS_OBJECT_PATH_NOT_FOUND,NT_STATUS_DOS(ERRDOS,ERRbadpath));
 
 	/* We expect this open to fail with the same error code as the chkpath below. */
diff --git a/source4/torture/raw/setfileinfo.c b/source4/torture/raw/setfileinfo.c
index e58b3fd760..90ccde7213 100644
--- a/source4/torture/raw/setfileinfo.c
+++ b/source4/torture/raw/setfileinfo.c
@@ -453,6 +453,10 @@ bool torture_raw_sfileinfo_rename(struct torture_context *torture,
 	char *fnum_fname_new;
 	char *path_fname;
 	char *path_fname_new;
+	char *path_dname;
+	char *path_dname_new;
+	char *saved_name;
+	char *saved_name_new;
 	union smb_fileinfo finfo1, finfo2;
 	union smb_setfileinfo sfinfo;
 	NTSTATUS status, status2;
@@ -464,6 +468,8 @@ bool torture_raw_sfileinfo_rename(struct torture_context *torture,
 	asprintf(&path_fname_new, BASEDIR "\\fname_test_new_%d.txt", n);
 	asprintf(&fnum_fname, BASEDIR "\\fnum_test_%d.txt", n);
 	asprintf(&fnum_fname_new, BASEDIR "\\fnum_test_new_%d.txt", n);
+	asprintf(&path_dname, BASEDIR "\\dname_test_%d", n);
+	asprintf(&path_dname_new, BASEDIR "\\dname_test_new_%d", n);
 
 	if (!torture_setup_dir(cli, BASEDIR)) {
 		return false;
@@ -553,17 +559,112 @@ bool torture_raw_sfileinfo_rename(struct torture_context *torture,
 	sfinfo.rename_information.in.root_fid = d_fnum;
 	CHECK_CALL_FNUM(RENAME_INFORMATION, NT_STATUS_INVALID_PARAMETER);
 	CHECK_STR(NAME_INFO, name_info, fname.s, fnum_fname);
+	smbcli_close(cli->tree, d_fnum);
 
-done:
-	smb_raw_exit(cli->session);
-	smbcli_close(cli->tree, fnum);
-	if (NT_STATUS_IS_ERR(smbcli_unlink(cli->tree, fnum_fname))) {
-		printf("Failed to delete %s - %s\n", fnum_fname, smbcli_errstr(cli->tree));
+	printf("Trying rename directory\n");
+	if (!torture_setup_dir(cli, path_dname)) {
+		ret = false;
+		goto done;
 	}
-	if (NT_STATUS_IS_ERR(smbcli_unlink(cli->tree, path_fname))) {
-		printf("Failed to delete %s - %s\n", path_fname, smbcli_errstr(cli->tree));
+	saved_name = path_fname;
+	saved_name_new = path_fname_new;
+	path_fname = path_dname;
+	path_fname_new = path_dname_new;
+	sfinfo.rename_information.in.new_name  = path_dname_new+strlen(BASEDIR)+1;
+	sfinfo.rename_information.in.overwrite = 0;
+	sfinfo.rename_information.in.root_fid  = 0;
+	CHECK_CALL_PATH(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname_new);
+	path_fname = saved_name;
+	path_fname_new = saved_name_new;
+
+	if (torture_setting_bool(torture, "samba3", false)) {
+		printf("SKIP: Trying rename directory with a handle\n");
+		printf("SKIP: Trying rename by path while a handle is open\n");
+		printf("SKIP: Trying rename directory by path while a handle is open\n");
+		goto done;
 	}
 
+	printf("Trying rename directory with a handle\n");
+	status = create_directory_handle(cli->tree, path_dname_new, &d_fnum);
+	fnum_saved = fnum;
+	fnum = d_fnum;
+	saved_name = fnum_fname;
+	saved_name_new = fnum_fname_new;
+	fnum_fname = path_dname;
+	fnum_fname_new = path_dname_new;
+	sfinfo.rename_information.in.new_name  = path_dname+strlen(BASEDIR)+1;
+	sfinfo.rename_information.in.overwrite = 0;
+	sfinfo.rename_information.in.root_fid  = 0;
+	CHECK_CALL_FNUM(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname);
+	smbcli_close(cli->tree, d_fnum);
+	fnum = fnum_saved;
+	fnum_fname = saved_name;
+	fnum_fname_new = saved_name_new;
+
+	printf("Trying rename by path while a handle is open\n");
+	fnum_saved = fnum;
+	fnum = create_complex_file(cli, torture, path_fname);
+	sfinfo.rename_information.in.new_name  = path_fname_new+strlen(BASEDIR)+1;
+	sfinfo.rename_information.in.overwrite = 0;
+	sfinfo.rename_information.in.root_fid  = 0;
+	CHECK_CALL_PATH(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_fname_new);
+	/* check that the handle returns the same name */
+	check_fnum = true;
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_fname_new);
+	/* rename it back on the handle */
+	sfinfo.rename_information.in.new_name  = path_fname+strlen(BASEDIR)+1;
+	CHECK_CALL_FNUM(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_fname);
+	check_fnum = false;
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_fname);
+	smbcli_close(cli->tree, fnum);
+	fnum = fnum_saved;
+
+	printf("Trying rename directory by path while a handle is open\n");
+	status = create_directory_handle(cli->tree, path_dname, &d_fnum);
+	fnum_saved = fnum;
+	fnum = d_fnum;
+	saved_name = path_fname;
+	saved_name_new = path_fname_new;
+	path_fname = path_dname;
+	path_fname_new = path_dname_new;
+	sfinfo.rename_information.in.new_name  = path_dname_new+strlen(BASEDIR)+1;
+	sfinfo.rename_information.in.overwrite = 0;
+	sfinfo.rename_information.in.root_fid  = 0;
+	CHECK_CALL_PATH(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname_new);
+	path_fname = saved_name;
+	path_fname_new = saved_name_new;
+	saved_name = fnum_fname;
+	saved_name_new = fnum_fname_new;
+	fnum_fname = path_dname;
+	fnum_fname_new = path_dname_new;
+	/* check that the handle returns the same name */
+	check_fnum = true;
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname_new);
+	/* rename it back on the handle */
+	sfinfo.rename_information.in.new_name  = path_dname+strlen(BASEDIR)+1;
+	CHECK_CALL_FNUM(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname);
+	fnum_fname = saved_name;
+	fnum_fname_new = saved_name_new;
+	saved_name = path_fname;
+	saved_name_new = path_fname_new;
+	path_fname = path_dname;
+	path_fname_new = path_dname_new;
+	check_fnum = false;
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname);
+	smbcli_close(cli->tree, d_fnum);
+	fnum = fnum_saved;
+	path_fname = saved_name;
+	path_fname_new = saved_name_new;
+
+done:
+	smb_raw_exit(cli->session);
+	smbcli_deltree(cli->tree, BASEDIR);
 	return ret;
 }
 
diff --git a/source4/torture/rpc/winreg.c b/source4/torture/rpc/winreg.c
index 4695733671..8b602ef652 100644
--- a/source4/torture/rpc/winreg.c
+++ b/source4/torture/rpc/winreg.c
@@ -848,7 +848,6 @@ static bool test_SecurityDescriptorInheritance(struct dcerpc_pipe *p,
 
  out:
 	test_CloseKey(p, tctx, &new_handle);
-	test_Cleanup(p, tctx, handle, TEST_SUBSUBKEY_SD);
 	test_Cleanup(p, tctx, handle, TEST_SUBKEY_SD);
 	test_RestoreSecurity(p, tctx, handle, key, sd_orig);
 
@@ -971,7 +970,6 @@ static bool test_SecurityDescriptorBlockInheritance(struct dcerpc_pipe *p,
 
  out:
 	test_CloseKey(p, tctx, &new_handle);
-	test_Cleanup(p, tctx, handle, TEST_SUBSUBKEY_SD);
 	test_Cleanup(p, tctx, handle, TEST_SUBKEY_SD);
 	test_RestoreSecurity(p, tctx, handle, key, sd_orig);
 
@@ -1386,27 +1384,6 @@ static bool test_DeleteKey(struct dcerpc_pipe *p, struct torture_context *tctx,
 	return true;
 }
 
-/* DeleteKey on a key with subkey(s) should
- * return WERR_ACCESS_DENIED. */
-static bool test_DeleteKeyWithSubkey(struct dcerpc_pipe *p,
-				     struct torture_context *tctx,
-				     struct policy_handle *handle,
-				     const char *key)
-{
-	struct winreg_DeleteKey r;
-
-	r.in.handle = handle;
-	init_winreg_String(&r.in.key, key);
-
-	torture_assert_ntstatus_ok(tctx, dcerpc_winreg_DeleteKey(p, tctx, &r),
-				   "DeleteKeyWithSubkey failed");
-
-	torture_assert_werr_equal(tctx, r.out.result, WERR_ACCESS_DENIED,
-				  "DeleteKeyWithSubkey failed");
-
-	return true;
-}
-
 static bool test_QueryInfoKey(struct dcerpc_pipe *p,
 			      struct torture_context *tctx,
 			      struct policy_handle *handle, char *class)
@@ -1443,10 +1420,12 @@ static bool test_QueryInfoKey(struct dcerpc_pipe *p,
 }
 
 static bool test_key(struct dcerpc_pipe *p, struct torture_context *tctx,
-		     struct policy_handle *handle, int depth);
+		     struct policy_handle *handle, int depth,
+		     bool test_security);
 
 static bool test_EnumKey(struct dcerpc_pipe *p, struct torture_context *tctx,
-			 struct policy_handle *handle, int depth)
+			 struct policy_handle *handle, int depth,
+			 bool test_security)
 {
 	struct winreg_EnumKey r;
 	struct winreg_StringBuf class, name;
@@ -1479,7 +1458,8 @@ static bool test_EnumKey(struct dcerpc_pipe *p, struct torture_context *tctx,
 			if (!test_OpenKey(p, tctx, handle, r.out.name->name,
 					  &key_handle)) {
 			} else {
-				test_key(p, tctx, &key_handle, depth + 1);
+				test_key(p, tctx, &key_handle,
+					 depth + 1, test_security);
 			}
 		}
 
@@ -1676,7 +1656,8 @@ static bool test_InitiateSystemShutdownEx(struct torture_context *tctx,
 #define MAX_DEPTH 2		/* Only go this far down the tree */
 
 static bool test_key(struct dcerpc_pipe *p, struct torture_context *tctx,
-		     struct policy_handle *handle, int depth)
+		     struct policy_handle *handle, int depth,
+		     bool test_security)
 {
 	if (depth == MAX_DEPTH)
 		return true;
@@ -1687,10 +1668,10 @@ static bool test_key(struct dcerpc_pipe *p, struct torture_context *tctx,
 	if (!test_NotifyChangeKeyValue(p, tctx, handle)) {
 	}
 
-	if (!test_GetKeySecurity(p, tctx, handle, NULL)) {
+	if (test_security && !test_GetKeySecurity(p, tctx, handle, NULL)) {
 	}
 
-	if (!test_EnumKey(p, tctx, handle, depth)) {
+	if (!test_EnumKey(p, tctx, handle, depth, test_security)) {
 	}
 
 	if (!test_EnumValue(p, tctx, handle, 0xFF, 0xFFFF)) {
@@ -1703,13 +1684,85 @@ static bool test_key(struct dcerpc_pipe *p, struct torture_context *tctx,
 
 typedef NTSTATUS (*winreg_open_fn)(struct dcerpc_pipe *, TALLOC_CTX *, void *);
 
+static bool test_Open_Security(struct torture_context *tctx,
+			       struct dcerpc_pipe *p, void *userdata)
+{
+	struct policy_handle handle, newhandle;
+	bool ret = true, created2 = false;
+	bool created4 = false;
+	struct winreg_OpenHKLM r;
+
+	winreg_open_fn open_fn = userdata;
+
+	r.in.system_name = 0;
+	r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
+	r.out.handle = &handle;
+
+	torture_assert_ntstatus_ok(tctx, open_fn(p, tctx, &r),
+				   "open");
+
+	test_Cleanup(p, tctx, &handle, TEST_KEY_BASE);
+
+	if (!test_CreateKey(p, tctx, &handle, TEST_KEY_BASE, NULL)) {
+		torture_comment(tctx,
+				"CreateKey (TEST_KEY_BASE) failed\n");
+	}
+
+	if (test_CreateKey_sd(p, tctx, &handle, TEST_KEY2,
+			      NULL, &newhandle)) {
+		created2 = true;
+	}
+
+	if (created2 && !test_CloseKey(p, tctx, &newhandle)) {
+		printf("CloseKey failed\n");
+		ret = false;
+	}
+
+	if (test_CreateKey_sd(p, tctx, &handle, TEST_KEY4, NULL, &newhandle)) {
+		created4 = true;
+	}
+
+	if (created4 && !test_CloseKey(p, tctx, &newhandle)) {
+		printf("CloseKey failed\n");
+		ret = false;
+	}
+
+	if (created4 && !test_SecurityDescriptors(p, tctx, &handle, TEST_KEY4)) {
+		ret = false;
+	}
+
+	if (created4 && !test_DeleteKey(p, tctx, &handle, TEST_KEY4)) {
+		printf("DeleteKey failed\n");
+		ret = false;
+	}
+
+	if (created2 && !test_DeleteKey(p, tctx, &handle, TEST_KEY2)) {
+		printf("DeleteKey failed\n");
+		ret = false;
+	}
+
+	/* The HKCR hive has a very large fanout */
+	if (open_fn == (void *)dcerpc_winreg_OpenHKCR) {
+		if(!test_key(p, tctx, &handle, MAX_DEPTH - 1, true)) {
+			ret = false;
+		}
+	} else {
+		if (!test_key(p, tctx, &handle, 0, true)) {
+			ret = false;
+		}
+	}
+
+	test_Cleanup(p, tctx, &handle, TEST_KEY_BASE);
+
+	return ret;
+}
+
 static bool test_Open(struct torture_context *tctx, struct dcerpc_pipe *p,
 		      void *userdata)
 {
 	struct policy_handle handle, newhandle;
-	bool ret = true, created = false, created2 = false, deleted = false;
+	bool ret = true, created = false, deleted = false;
 	bool created3 = false, created_subkey = false;
-	bool created4 = false;
 	struct winreg_OpenHKLM r;
 
 	winreg_open_fn open_fn = userdata;
@@ -1721,15 +1774,13 @@ static bool test_Open(struct torture_context *tctx, struct dcerpc_pipe *p,
 	torture_assert_ntstatus_ok(tctx, open_fn(p, tctx, &r),
 				   "open");
 
-	test_Cleanup(p, tctx, &handle, TEST_KEY1);
-	test_Cleanup(p, tctx, &handle, TEST_SUBSUBKEY_SD);
-	test_Cleanup(p, tctx, &handle, TEST_SUBKEY_SD);
-	test_Cleanup(p, tctx, &handle, TEST_KEY4);
-	test_Cleanup(p, tctx, &handle, TEST_KEY2);
-	test_Cleanup(p, tctx, &handle, TEST_SUBKEY);
-	test_Cleanup(p, tctx, &handle, TEST_KEY3);
 	test_Cleanup(p, tctx, &handle, TEST_KEY_BASE);
 
+	if (!test_CreateKey(p, tctx, &handle, TEST_KEY_BASE, NULL)) {
+		torture_comment(tctx,
+				"CreateKey (TEST_KEY_BASE) failed\n");
+	}
+
 	if (!test_CreateKey(p, tctx, &handle, TEST_KEY1, NULL)) {
 		torture_comment(tctx,
 				"CreateKey failed - not considering a failure\n");
@@ -1763,9 +1814,12 @@ static bool test_Open(struct torture_context *tctx, struct dcerpc_pipe *p,
 	}
 
 	if (created && deleted &&
-	    test_OpenKey(p, tctx, &handle, TEST_KEY1, &newhandle)) {
+	    !_test_OpenKey(p, tctx, &handle, TEST_KEY1,
+			   SEC_FLAG_MAXIMUM_ALLOWED, &newhandle,
+			   WERR_BADFILE, NULL)) {
 		torture_comment(tctx,
-				"DeleteKey failed (OpenKey after Delete worked)\n");
+				"DeleteKey failed (OpenKey after Delete "
+				"did not return WERR_BADFILE)\n");
 		ret = false;
 	}
 
@@ -1774,40 +1828,6 @@ static bool test_Open(struct torture_context *tctx, struct dcerpc_pipe *p,
 		ret = false;
 	}
 
-	if (created && test_CreateKey_sd(p, tctx, &handle, TEST_KEY2,
-					 NULL, &newhandle)) {
-		created2 = true;
-	}
-
-	if (created2 && !test_CloseKey(p, tctx, &newhandle)) {
-		printf("CloseKey failed\n");
-		ret = false;
-	}
-
-	if (test_CreateKey_sd(p, tctx, &handle, TEST_KEY4, NULL, &newhandle)) {
-		created4 = true;
-	}
-
-	if (!created4 && !test_CloseKey(p, tctx, &newhandle)) {
-		printf("CloseKey failed\n");
-		ret = false;
-	}
-
-	if (created4 && !test_SecurityDescriptors(p, tctx, &handle, TEST_KEY4)) {
-		ret = false;
-	}
-
-	if (created4 && !test_DeleteKey(p, tctx, &handle, TEST_KEY4)) {
-		printf("DeleteKey failed\n");
-		ret = false;
-	}
-
-
-	if (created && !test_DeleteKey(p, tctx, &handle, TEST_KEY2)) {
-		printf("DeleteKey failed\n");
-		ret = false;
-	}
-
 	if (created && test_CreateKey(p, tctx, &handle, TEST_KEY3, NULL)) {
 		created3 = true;
 	}
@@ -1818,19 +1838,6 @@ static bool test_Open(struct torture_context *tctx, struct dcerpc_pipe *p,
 	}
 
 	if (created_subkey &&
-	    !test_DeleteKeyWithSubkey(p, tctx, &handle, TEST_KEY3)) {
-		printf("DeleteKeyWithSubkey failed "
-		       "(DeleteKey didn't return ACCESS_DENIED)\n");
-		ret = false;
-	}
-
-	if (created_subkey &&
-	    !test_DeleteKey(p, tctx, &handle, TEST_SUBKEY)) {
-		printf("DeleteKey failed\n");
-		ret = false;
-	}
-
-	if (created3 &&
 	    !test_DeleteKey(p, tctx, &handle, TEST_KEY3)) {
 		printf("DeleteKey failed\n");
 		ret = false;
@@ -1838,13 +1845,13 @@ static bool test_Open(struct torture_context *tctx, struct dcerpc_pipe *p,
 
 	/* The HKCR hive has a very large fanout */
 	if (open_fn == (void *)dcerpc_winreg_OpenHKCR) {
-		if(!test_key(p, tctx, &handle, MAX_DEPTH - 1)) {
+		if(!test_key(p, tctx, &handle, MAX_DEPTH - 1, false)) {
+			ret = false;
+		}
+	} else {
+		if (!test_key(p, tctx, &handle, 0, false)) {
 			ret = false;
 		}
-	}
-
-	if (!test_key(p, tctx, &handle, 0)) {
-		ret = false;
 	}
 
 	test_Cleanup(p, tctx, &handle, TEST_KEY_BASE);
@@ -1854,14 +1861,6 @@ static bool test_Open(struct torture_context *tctx, struct dcerpc_pipe *p,
 
 struct torture_suite *torture_rpc_winreg(TALLOC_CTX *mem_ctx)
 {
-	struct {
-		const char *name;
-		winreg_open_fn fn;
-	} open_fns[] = {{"OpenHKLM", (winreg_open_fn)dcerpc_winreg_OpenHKLM },
-			{"OpenHKU",  (winreg_open_fn)dcerpc_winreg_OpenHKU },
-			{"OpenHKCR", (winreg_open_fn)dcerpc_winreg_OpenHKCR },
-			{"OpenHKCU", (winreg_open_fn)dcerpc_winreg_OpenHKCU }};
-	int i;
 	struct torture_rpc_tcase *tcase;
 	struct torture_suite *suite = torture_suite_create(mem_ctx, "WINREG");
 	struct torture_test *test;
@@ -1877,10 +1876,33 @@ struct torture_suite *torture_rpc_winreg(TALLOC_CTX *mem_ctx)
 					  test_InitiateSystemShutdownEx);
 	test->dangerous = true;
 
-	for (i = 0; i < ARRAY_SIZE(open_fns); i++) {
-		torture_rpc_tcase_add_test_ex(tcase, open_fns[i].name,
-					      test_Open, open_fns[i].fn);
-	}
+	/* Basic tests without security descriptors */
+	torture_rpc_tcase_add_test_ex(tcase, "HKLM-basic",
+				      test_Open,
+				      (winreg_open_fn)dcerpc_winreg_OpenHKLM);
+	torture_rpc_tcase_add_test_ex(tcase, "HKU-basic",
+				      test_Open,
+				      (winreg_open_fn)dcerpc_winreg_OpenHKU);
+	torture_rpc_tcase_add_test_ex(tcase, "HKCR-basic",
+				      test_Open,
+				      (winreg_open_fn)dcerpc_winreg_OpenHKCR);
+	torture_rpc_tcase_add_test_ex(tcase, "HKCU-basic",
+				      test_Open,
+				      (winreg_open_fn)dcerpc_winreg_OpenHKCU);
+
+	/* Security descriptor tests */
+	torture_rpc_tcase_add_test_ex(tcase, "HKLM-security",
+				      test_Open_Security,
+				      (winreg_open_fn)dcerpc_winreg_OpenHKLM);
+	torture_rpc_tcase_add_test_ex(tcase, "HKU-security",
+				      test_Open_Security,
+				      (winreg_open_fn)dcerpc_winreg_OpenHKU);
+	torture_rpc_tcase_add_test_ex(tcase, "HKCR-security",
+				      test_Open_Security,
+				      (winreg_open_fn)dcerpc_winreg_OpenHKCR);
+	torture_rpc_tcase_add_test_ex(tcase, "HKCU-security",
+				      test_Open_Security,
+				      (winreg_open_fn)dcerpc_winreg_OpenHKCU);
 
 	return suite;
 }