From: Victor Julien <victor@inliniac.net>
Date: Thu, 30 Nov 2017 06:53:31 +0000 (+0100)
Subject: detect/flowint: only check if packet has flow
X-Git-Tag: suricata-4.1.0-beta1~523
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=40a819d5a613c88502ca22649affea288a8e4c0b;p=thirdparty%2Fsuricata.git

detect/flowint: only check if packet has flow

Fixed bug #2288.
---

diff --git a/src/detect.c b/src/detect.c
index 19e49d0e42..c756ab2ec5 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -2071,6 +2071,12 @@ static int SignatureCreateMask(Signature *s)
                         "flowbit(s)");
                 break;
             }
+            case DETECT_FLOWINT:
+                /* flow is required for any flowint manipulation */
+                s->mask |= SIG_MASK_REQUIRE_FLOW;
+                SCLogDebug("sig requires flow to be able to manipulate "
+                        "flowint(s)");
+                break;
             case DETECT_FLAGS:
             {
                 DetectFlagsData *fl = (DetectFlagsData *)sm->ctx;