> The attached diff contains code to do two things.
>
> 1. dissect the auth info in connection oriented dcerpc packets.
Checked in.
> 2. modifies packet-nbns.c to use pass off netbios session packets to
> heuristic dissectors, and packet-dcerpc.c registers itself there.
I've checked in a variant of that. Instead of just modifying the NBSS
dissector, I've created a new "dissect_netbios_payload()" routine,
called by the NetBIOS-over-802.2 (NetBEUI or NBF), NetBIOS-over-IPX, and
NetBIOS-over-TCP datagram and session service dissectors.
That routine has the heuristic dissector calls, as well as the SMB
dissector call. I've also made the SMB dissector heuristic (although
it's still a special dissector; once it's tvbuffified, it can become a
normal heuristic dissector), so that it doesn't dissect anything that
doesn't being with 0xFF S M B.
> Note that for this to work, I've had to comment out the #define RJSHACK,
I left that in, but removed the check for 0xFF S M B; it still checks
for valid NBSS packet types.
> because it's just, well, wrong. I think the correct solution is to
> make the SMB dissector a heuristic dissector as well, and then if no
> dissector claims a nbns packet, do the stuff in the RJSHACK code.
Unfortunately, it's a bit more complicated - "dissect_nbss()" dissects
*multiple* NBSS packets within the data it's handed, and it doesn't call
"dissect_netbios_payload()" until after it's dissected the NBSS header
and put it into the protocol tree.
In order to do that, we'd have to split heuristic dissectors into a
heuristic routine and a dissector routine - the first of them would
check the packet data and return TRUE or FALSE, but would not put
anything into the protocol tree, and the second of them would dissect
without doing any checks or returning any matched/not matched value.
Then "dissect_nbss_packet()" would have to call the heuristic routines
*before* putting anything into the protocol tree; presumably the routine
to call the heuristic routines could return either a pointer to the
right dissector routine or NULL.
