From fd31e5095462417abdade180e3cda64e04be9954 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 16 Apr 2026 14:55:15 -0600
Subject: [PATCH] ntp: enable keywords for firewall mode

Ticket: #8394
---
 rust/src/ntp/detect.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/rust/src/ntp/detect.rs b/rust/src/ntp/detect.rs
index 13c0475933..44ca34b9e2 100644
--- a/rust/src/ntp/detect.rs
+++ b/rust/src/ntp/detect.rs
@@ -22,7 +22,7 @@ use crate::detect::uint::{
 };
 use crate::detect::{
     helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_ENUM_UINT,
-    SIGMATCH_INFO_UINT8,
+    SIGMATCH_INFO_UINT8, SIGMATCH_SUPPORT_FIREWALL
 };
 use std::ffi::CStr;
 use std::os::raw::{c_int, c_void};
@@ -30,7 +30,7 @@ use suricata_sys::sys::{
     DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
     SCDetectHelperBufferProgressMpmRegister, SCDetectHelperBufferProgressRegister,
     SCDetectHelperKeywordRegister, SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList,
-    SCSigTableAppLiteElmt, SigMatchCtx, Signature,
+    SCSigTableAppLiteElmt, SigMatchCtx, Signature
 };
 
 static mut G_NTP_VERSION_KW_ID: u16 = 0;
@@ -199,7 +199,7 @@ pub(super) unsafe extern "C" fn detect_ntp_register() {
         AppLayerTxMatch: Some(ntp_detect_version_match),
         Setup: Some(ntp_detect_version_setup),
         Free: Some(ntp_detect_u8_free),
-        flags: SIGMATCH_INFO_UINT8,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_SUPPORT_FIREWALL,
     };
     G_NTP_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_NTP_GENERIC_BUFFER_ID = SCDetectHelperBufferProgressRegister(
@@ -216,7 +216,7 @@ pub(super) unsafe extern "C" fn detect_ntp_register() {
         AppLayerTxMatch: Some(ntp_detect_mode_match),
         Setup: Some(ntp_detect_mode_setup),
         Free: Some(ntp_detect_u8_free),
-        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_ENUM_UINT,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_ENUM_UINT | SIGMATCH_SUPPORT_FIREWALL,
     };
     G_NTP_MODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
 
@@ -227,7 +227,7 @@ pub(super) unsafe extern "C" fn detect_ntp_register() {
         AppLayerTxMatch: Some(ntp_detect_stratum_match),
         Setup: Some(ntp_detect_stratum_setup),
         Free: Some(ntp_detect_u8_free),
-        flags: SIGMATCH_INFO_UINT8,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_SUPPORT_FIREWALL,
     };
     G_NTP_STRATUM_KW_ID = SCDetectHelperKeywordRegister(&kw);