diff --git a/src/detect-ftp-completion-code.c b/src/detect-ftp-completion-code.c index 2fd572bc43..7474a1658b 100644 --- a/src/detect-ftp-completion-code.c +++ b/src/detect-ftp-completion-code.c @@ -93,10 +93,11 @@ void DetectFtpCompletionCodeRegister(void) sigmatch_table[DETECT_FTP_COMPLETION_CODE].url = "/rules/" KEYWORD_DOC; sigmatch_table[DETECT_FTP_COMPLETION_CODE].Setup = DetectFtpCompletionCodeSetup; sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags = - SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER; + SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER | + SIGMATCH_SUPPORT_FIREWALL; - DetectAppLayerMultiRegister( - BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 0, DetectFTPCompletionCodeGetData, 2); + DetectAppLayerMultiRegister(BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, FTP_STATE_FINISHED, + DetectFTPCompletionCodeGetData, 2); DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);