1 files changed, 40 insertions, 1 deletions

diff --git a/src/lib/protocols/mail_pop.c b/src/lib/protocols/mail_pop.c
index c3ab9ffe0..d12ded666 100644
--- a/src/lib/protocols/mail_pop.c
+++ b/src/lib/protocols/mail_pop.c
@@ -48,6 +48,11 @@ static void ndpi_int_mail_pop_add_connection(struct ndpi_detection_module_struct
   ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MAIL_POP, NDPI_PROTOCOL_UNKNOWN);
 }
 
+/* **************************************** */
+
+static void popInitExtraPacketProcessing(struct ndpi_flow_struct *flow);
+
+/* **************************************** */
 
 static int ndpi_int_mail_pop_check_for_client_commands(struct ndpi_detection_module_struct
 						       *ndpi_struct, struct ndpi_flow_struct *flow) {
@@ -174,8 +179,10 @@ void ndpi_search_mail_pop_tcp(struct ndpi_detection_module_struct
 	NDPI_LOG_INFO(ndpi_struct, "mail_pop identified\n");
 	
 	if((flow->protos.ftp_imap_pop_smtp.password[0] != '\0')
-	   || (flow->l4.tcp.mail_pop_stage > 3))
+	   || (flow->l4.tcp.mail_pop_stage > 3)) {
 	  ndpi_int_mail_pop_add_connection(ndpi_struct, flow);
+	  popInitExtraPacketProcessing(flow);
+	}
       }
       
       return;      
@@ -203,6 +210,38 @@ void ndpi_search_mail_pop_tcp(struct ndpi_detection_module_struct
 }
 
 
+/* **************************************** */
+
+int ndpi_extra_search_mail_pop_tcp(struct ndpi_detection_module_struct *ndpi_struct,
+				    struct ndpi_flow_struct *flow) {
+  int rc;
+  
+  ndpi_search_mail_pop_tcp(ndpi_struct, flow);
+
+  rc = (flow->protos.ftp_imap_pop_smtp.password[0] == '\0') ? 1 : 0;
+  
+#ifdef POP_DEBUG
+  printf("**** %s() [rc: %d]\n", __FUNCTION__, rc);
+#endif  
+
+  return(rc);
+}
+
+/* **************************************** */
+
+static void popInitExtraPacketProcessing(struct ndpi_flow_struct *flow) {
+#ifdef POP_DEBUG
+  printf("**** %s()\n", __FUNCTION__);
+#endif
+  
+  flow->check_extra_packets = 1;
+  /* At most 7 packets should almost always be enough */
+  flow->max_extra_packets_to_check = 7;
+  flow->extra_packets_func = ndpi_extra_search_mail_pop_tcp;
+}
+
+/* **************************************** */
+
 void init_mail_pop_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 			     u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
   ndpi_set_bitmask_protocol_detection("MAIL_POP", ndpi_struct, detection_bitmask, *id,