From d1da9701a270f66935dbe41d5a543f0e0a9ff483 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Mon, 22 Jun 2026 17:09:56 -0600 Subject: [PATCH] ftp: register ftp.completion_code at response_complete Ticket: #8392 (cherry picked from commit fc1546e25ece0fdfcaf23d6673ccd448e3e8ae57) --- src/detect-ftp-completion-code.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/detect-ftp-completion-code.c b/src/detect-ftp-completion-code.c index fe7eeb9636..d1cab1bacd 100644 --- a/src/detect-ftp-completion-code.c +++ b/src/detect-ftp-completion-code.c @@ -92,10 +92,11 @@ void DetectFtpCompletionCodeRegister(void) "sticky buffer to match on the FTP completion code buffer"; sigmatch_table[DETECT_FTP_COMPLETION_CODE].url = "/rules/" KEYWORD_DOC; sigmatch_table[DETECT_FTP_COMPLETION_CODE].Setup = DetectFtpCompletionCodeSetup; - sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags |= SIGMATCH_NOOPT; + sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags = + SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_SUPPORT_FIREWALL; - DetectAppLayerMultiRegister( - BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 0, DetectFTPCompletionCodeGetData, 2); + DetectAppLayerMultiRegister(BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, FTP_STATE_FINISHED, + DetectFTPCompletionCodeGetData, 2); DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);