problem retrieving level 3 info for NT printer drivers

[Ronan Waide]

Hi folks,

mentioned this briefly on samba@ about a week ago, but I've actually
done some tracking on it now. I'm still digging, but this is a summary
of what I've found.

symptoms: doing rpcclient SERVER "enumdrivers level 3" fetches
information for the Windows 9x drivers, then stalls trying to retrieve
the NT information, before returning a timeout message. Level 1 and 2
work fine.

I ran ethereal and poked at the traces some, and this is what I get:

client: EnumPrinterDrivers request level 3
server: EnumPrinterDrivers reply, Insufficient Buffer
client: EnumPrinterDrivers request level 3 (this time with a buffer)
server: EnumPrinterDrivers reply

At this point, I have the Windows 4.0 drivers.

client: EnumPrinterDrivers request level 3
server: EnumPrinterDrivers reply, Insufficient Buffer
client: DCERPC request
server: no apparent response
client: SMB WriteAndXRequest
server: SMB WriteAndXResponse
server: SMB WriteAndXResponse
client: SMB WriteAndXRequest
client: SMB WriteAndXRequest

and that's about it. Error message goes hereabouts.

Having looked at the DCERPC request above, it appears to be contained
in a SMB WriteAndXRequest whereas the corresponding request with a
buffer for the Windows 4.0 drivers is a Transaction request. Also, the
DCERPC request appears to have the necessary bits appended after the
DCERPC header to make it a SPOOLSS request (as I'd expect) with the
required amount of buffer space, but ethereal certainly doesn't want
to read it as such, and my knowledge of SMB is pretty minimal. My
theory, such as it is, is that the buffer size is too big, for some
arbitrary meaning of the phrase "too big". It's a 16452-byte buffer,
where the Windows 4.0 buffer size was something like 2400 bytes. I'm
going to play around with buffer sizes and see if I can at least get
the message sequences the way I'd expect 'em, but any light-shedding
would be appreciated :)

Cheers,
Waider.
-- 
waider at waider.ie / Yes, it /is/ very personal of me.

"Your broker is a half-naked blue-and-orange crypto-anarchist?"
                              - Neal Stephenson / The Great Simoleon Caper