Theo <theom+news@chiark.greenend.org.uk> wrote:
> Have you tried sending a Unirast file to an Airprint printer?

Ah, according to:
https://wiki.debian.org/CUPSAirPrint
I can get some information out of my printer:
('xxxx' redacts some serial numbers)

$ avahi-browse -rt _ipp._tcp
+ wlp0s20f3 IPv6 Brother HL-L8260CDW series Internet
Printer local
+ wlp0s20f3 IPv4 Brother HL-L8260CDW series Internet
Printer local
= wlp0s20f3 IPv6 Brother HL-L8260CDW series Internet
Printer local
hostname = [BRWD46A6Axxxx.local]
address = [192.168.1.3]
port = [631]
txt = ["mopria-certified=1.3" "print_wfds=T"
"UUID=e3248000-80ce-11db-8000-xxxx" "PaperMax=legal-A4"
"kind=document,envelope,label,postcard"
"URF=SRGB24,W8,CP1,IS19-1,MT1-3-4-5-8-11,OB10,PQ4,RS600,V1.4,DM1"
"TBCP=F" "Transparent=T" "Binary=T" "PaperCustom=T" "Scan=F" "Fax=F"
"Duplex=T" "Copies=T" "Color=T" "usb_CMD=PJL,PCL,PCLXL,URF"
"usb_MDL=HL-L8260CDW series" "usb_MFG=Brother" "priority=25"
"adminurl=http://BRWD46A6xxxx.local./net/net/airprint.html"
"product=(Brother HL-L8260CDW series)" "ty=Brother HL-L8260CDW series"
"note=" "rp=ipp/print"
"pdl=application/octet-stream,image/urf,image/jpeg,image/pwg-raster"
"qtotal=1" "txtvers=1"]
= wlp0s20f3 IPv4 Brother HL-L8260CDW series Internet
Printer local
hostname = [BRWD46A6Axxxx.local]
address = [192.168.1.3]
port = [631]
txt = ["mopria-certified=1.3" "print_wfds=T"
"UUID=e3248000-80ce-11db-8000-xxxx" "PaperMax=legal-A4"
"kind=document,envelope,label,postcard"
"URF=SRGB24,W8,CP1,IS19-1,MT1-3-4-5-8-11,OB10,PQ4,RS600,V1.4,DM1"
"TBCP=F" "Transparent=T" "Binary=T" "PaperCustom=T" "Scan=F" "Fax=F"
"Duplex=T" "Copies=T" "Color=T" "usb_CMD=PJL,PCL,PCLXL,URF"
"usb_MDL=HL-L8260CDW series" "usb_MFG=Brother" "priority=25"
"adminurl=http://BRWD46A6Axxxx.local./net/net/airprint.html"
"product=(Brother HL-L8260CDW series)" "ty=Brother HL-L8260CDW series"
"note=" "rp=ipp/print"
"pdl=application/octet-stream,image/urf,image/jpeg,image/pwg-raster"
"qtotal=1" "txtvers=1"]

so it can take URF, as well as JPEG and PWG. Perhaps, if the client
discovers that, it can choose to send via any supported format.
I would assume that iOS would send URF as the lowest common denominator?

[time passes]

It appears that I can run Wireshark on my wifi, but it can only see
traffic destined for the machine running Wireshark - it can't see the chat
between my phone and the printer. To do that I'd need to put both the phone
and printer on an open wifi network that I can sniff. That will be a task
for another day...

Theo

Theo <theom+news@chiark.greenend.org.uk> wrote:
> It appears that I can run Wireshark on my wifi, but it can only see
> traffic destined for the machine running Wireshark - it can't see the chat
> between my phone and the printer. To do that I'd need to put both the phone
> and printer on an open wifi network that I can sniff. That will be a task
> for another day...

Somebody already did this:
https://weberblog.net/a-little-printing-please-packet-capture/

According to the pcap (in Wireshark filter on 'ipp'):

MDNS says:
HP LaserJet 200 colorMFP M276n (025A4D)_ipp_tcplocal) ;

IPP says:
POST /ipp/print HTTP/1.1
Content-Length: 823
Content-Type: application/ipp
Date: Wed, 19 Aug 2020 10:36:43 GMT
Host: NPI025A4D.local:631
User-Agent: CUPS/2.3.0 (iOS 13.6.1; iPhone10,4) IPP/2.0
Expect: 100-continue

(a lot of IPP chitchat about media sizes etc)

document-format-supported:
image/urf
application/pdf
application/postscript
application/vnd.hp-PCL
application/vnd.hp-PCLXL
application/PCLm
application/octet-stream

and a PDF is sent.

So it appears iOS won't necessarily send PWG or URF if there's another
option.

Theo

In message <BBe*QX9Dy@news.chiark.greenend.org.uk>
Theo <theom+news@chiark.greenend.org.uk> wrote:

> Theo <theom+news@chiark.greenend.org.uk> wrote:
> > It appears that I can run Wireshark on my wifi, but it can only see
> > traffic destined for the machine running Wireshark - it can't see the
> > chat between my phone and the printer. To do that I'd need to put both
> > the phone and printer on an open wifi network that I can sniff. That
> > will be a task for another day...
>
> Somebody already did this:
> https://weberblog.net/a-little-printing-please-packet-capture/
>
> According to the pcap (in Wireshark filter on 'ipp'):
>
> MDNS says:
> HP LaserJet 200 colorMFP M276n (025A4D)_ipp_tcplocal) ;
>
> IPP says:
> POST /ipp/print HTTP/1.1
> Content-Length: 823
> Content-Type: application/ipp
> Date: Wed, 19 Aug 2020 10:36:43 GMT
> Host: NPI025A4D.local:631
> User-Agent: CUPS/2.3.0 (iOS 13.6.1; iPhone10,4) IPP/2.0
> Expect: 100-continue
>
> (a lot of IPP chitchat about media sizes etc)
>
> document-format-supported:
> image/urf
> application/pdf
> application/postscript
> application/vnd.hp-PCL
> application/vnd.hp-PCLXL
> application/PCLm
> application/octet-stream
>
> and a PDF is sent.
>
> So it appears iOS won't necessarily send PWG or URF if there's another
> option.

I may have missed it, but I didn't see what type of file he printed.
If it was a PDF, I would expect the computer's printing system to take
the line of least resistance and ship it out direct because the printer
can handle it directly.

The above list of formats: is it complete? Didn't it include PWG-Raster?
HP seems to be its biggest supporter.

I have some reverse engineered documentation of Unirast, and it seems
reasonable to guess that "image/urf" is Unirast. What I don't know
for sure is whether the information I have is up to date. We all know
how much protocols are subject to change in the IT industry.

David

In message <zBe*tt8Dy@news.chiark.greenend.org.uk>
Theo <theom+news@chiark.greenend.org.uk> wrote:

> David Higton <dave@davehigton.me.uk> wrote:
> > Can you confirm that AirPrint does indeed use UniRaster; print to file
> > would have "UNIRAST\0" inthe first 8 bytes?
>
> I'm not sure how I find out - my iPhone won't print to file, only to
> something that advertises itself as a printer (the only thing I have being
> an actual printer). On MacOS there's CUPS in the way - you can print to
> PDF, which is presumably the input format to CUPS, but I'm not sure how to
> print to file of the output destined for a specific printer. The spool
> file (/var/spool/cups/dNNNNNN-NNN) is a PDF.
>
> Have you tried sending a Unirast file to an Airprint printer?

I don't have access to an Airprint printer.

David

David Higton <dave@davehigton.me.uk> wrote:
> I may have missed it, but I didn't see what type of file he printed.
> If it was a PDF, I would expect the computer's printing system to take
> the line of least resistance and ship it out direct because the printer
> can handle it directly.

It was a PDF (it can be extracted from the pcap - a printout of
http://ip.webernetz.net/
which dumps the User-Agent etc of the browser request)

> The above list of formats: is it complete? Didn't it include PWG-Raster?
> HP seems to be its biggest supporter.

That's it, as returned from IPP Get-Printer-Attributes. No PWG.
There's no mention of PWG in the spec either:
https://support.hp.com/us-en/product/hp-laserjet-pro-200-color-mfp-m276/5097648/model/5097649/document/c03315988
(it does say 'Apple Airprint')

> I have some reverse engineered documentation of Unirast, and it seems
> reasonable to guess that "image/urf" is Unirast. What I don't know
> for sure is whether the information I have is up to date. We all know
> how much protocols are subject to change in the IT industry.

I did this:

$ git clone https://github.com/AlanQuatermain/unirast.git
Cloning into 'unirast'...
remote: Enumerating objects: 14, done.
remote: Total 14 (delta 0), reused 0 (delta 0), pack-reused 14
Receiving objects: 100% (14/14), 1.65 MiB | 2.40 MiB/s, done.
Resolving deltas: 100% (6/6), done.
$ cd unirast/
$ ls
17-pages.urf 1-page.urf partial_decode.txt
$ cat 1-page.urf | nc 192.168.1.3 9100

and I got a pile of paper starting with 'UNIRAST' and then garbage
characters. Looks like the printer decided it was a text file, rather than
a file to parse. Although I don't know if you have to indicate a MIME type
when using AppSocket/JetDirect, else it'll assume it's plain text or PCL/PS?

Theo

David Higton <dave@davehigton.me.uk> wrote:
> I don't have access to an Airprint printer.

If there's anything you want me to try, feel free to send me files.

Although it seems that the only examples I can find of Unirast don't work.
I found this:
https://github.com/Bondvet/imageurf
but I'm not very experienced with Node and not sure what kind of closure I
need to supply to it to make it save a URF for inspection - at the
moment it goes PNG -> URF -> PNG which isn't much use.

Theo

On 12/01/2022 22:46, Theo wrote:
> It appears that I can run Wireshark on my wifi, but it can only see
> traffic destined for the machine running Wireshark - it can't see the chat
> between my phone and the printer. To do that I'd need to put both the phone
> and printer on an open wifi network that I can sniff. That will be a task
> for another day...

You need to put your WiFi card in promiscuous mode.

---druck

druck <news@druck.org.uk> wrote:
> On 12/01/2022 22:46, Theo wrote:
> > It appears that I can run Wireshark on my wifi, but it can only see
> > traffic destined for the machine running Wireshark - it can't see the chat
> > between my phone and the printer. To do that I'd need to put both the phone
> > and printer on an open wifi network that I can sniff. That will be a task
> > for another day...
>
> You need to put your WiFi card in promiscuous mode.

It doesn't work like that. If you have WPA enabled, stations can't see the
traffic of other stations because it's encrypted. That's why people in
Starbucks can't intercept the traffic of other people in Starbucks.

You can put your wifi card in monitor mode, which gives you access to raw
802.11 packets (station broadcasts etc). But it still doesn't allow you to
see the traffic of other users talking to the access point.

Theo