From 0f168d9150cfcc94464b84591605a2c5e17c728e Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Thu, 11 Nov 2021 11:55:56 +0100
Subject: IMAP, POP3, SMTP: improve dissection (#1368)

Avoid NATS false positives
---
 src/lib/ndpi_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/lib/ndpi_main.c')

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 907cc019f..0ab5e6c9a 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -7247,7 +7247,8 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp
   case NDPI_PROTOCOL_MAIL_IMAP:
   case NDPI_PROTOCOL_MAIL_SMTP:
     if(flow->protos.ftp_imap_pop_smtp.password[0] == '\0' &&
-       flow->protos.ftp_imap_pop_smtp.auth_tls == 0)
+       flow->protos.ftp_imap_pop_smtp.auth_tls == 0 &&
+       flow->protos.ftp_imap_pop_smtp.auth_done == 0)
       return(1);
     break;
 
-- 
cgit v1.2.3