diff --git a/src/detect-ftp-completion-code.c b/src/detect-ftp-completion-code.c index fe7eeb9636..d1cab1bacd 100644 --- a/src/detect-ftp-completion-code.c +++ b/src/detect-ftp-completion-code.c @@ -92,10 +92,11 @@ void DetectFtpCompletionCodeRegister(void) "sticky buffer to match on the FTP completion code buffer"; sigmatch_table[DETECT_FTP_COMPLETION_CODE].url = "/rules/" KEYWORD_DOC; sigmatch_table[DETECT_FTP_COMPLETION_CODE].Setup = DetectFtpCompletionCodeSetup; - sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags |= SIGMATCH_NOOPT; + sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags = + SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_SUPPORT_FIREWALL; - DetectAppLayerMultiRegister( - BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 0, DetectFTPCompletionCodeGetData, 2); + DetectAppLayerMultiRegister(BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, FTP_STATE_FINISHED, + DetectFTPCompletionCodeGetData, 2); DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);