detect/flowint: only check if packet has flow

Fixed bug #2288.

diff --git a/src/detect.c b/src/detect.c
index 19e49d0e429fe5bfb3fe3be0730ce670cb29c047..c756ab2ec5d040a4bf975c04cbf0d865c82c8884 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -2071,6 +2071,12 @@ static int SignatureCreateMask(Signature *s)
                         "flowbit(s)");
                 break;
             }
+            case DETECT_FLOWINT:
+                /* flow is required for any flowint manipulation */
+                s->mask |= SIG_MASK_REQUIRE_FLOW;
+                SCLogDebug("sig requires flow to be able to manipulate "
+                        "flowint(s)");
+                break;
             case DETECT_FLAGS:
             {
                 DetectFlagsData *fl = (DetectFlagsData *)sm->ctx;