NetShareEnumAll raises UnexpectedStatusCode 'STATUS_BUFFER_OVERFLOW' when result is bigger than 1024 bytes

[14mRh4X0r]

When NetShareEnumAll results (through RubySMB::Client#net_share_enum_all) are more than Ioctl's max_output_response bytes long (1024 by default), at least RubySMB::SMB2::Dcerpc#request raises a RubySMB::Error::UnexpectedStatusCode with the message 'STATUS_BUFFER_OVERFLOW'.

Additionally, when changing Dcerpc#net_share_enum_all to call request with max_recv_frag from BindAck as the max_output_response value (i.e. mimicking smbclient), the SMB2Header gets reset to defaults, causing the remote server to abort the connection.

This is the output of smbclient -L:

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	D$              Disk      Default share
	E$              Disk      Default share
	H$              Disk      Default share
	IPC$            IPC       Remote IPC
	K$              Disk      Default share
	K3              Disk      
	M$              Disk      Default share
	NETLOGON        Disk      Logon server share 
	P               Disk      
	P$              Disk      Default share
	print$          Disk      Printer Drivers
	S$              Disk      Default share
	Series Mirror   Disk      
	Series_Mirror   Disk      
	Share           Disk      
	SYSVOL          Disk      Logon server share 
	T$              Disk      Default share

[busterb]

Hmm, so we need to advertise a bigger buffer in the request?

[14mRh4X0r]

I think that's a workaround rather than a solution.
From what I gather, STATUS_BUFFER_OVERFLOW is not an error as much as an indication that it has more data than we advertised we could handle; the server I tested against happily returned the first 1024 bytes of the DCERPC data. There is probably a way to request the rest of the data.

[14mRh4X0r]

After reading the spec, yes, we should advertise a bigger buffer. Preferably the size returned by the server in the bind ack, if it's not too large.