Suricata

this signature can be used to drop http connections:

drop tcp any any -> any 80 (msg:"Snort_Inline is blocking the http link"; sid:1; content:"/";)

but this signature can't be:

drop tcp any any -> any 80 (msg:"Snort_Inline is blocking the http link"; sid:1;)

so for some reason we need a content match to be able to match.

I suspect somehow the setting of the SIG_FLAG_PAYLOAD flag in a signature has something to do with it.

Please add a unittest on the matching itself and confirm that the patch properly drops.