http2: do not log an empty settings array

An empty SETTINGS frame (an ACK, or a SETTINGS without entries) opened
the settings array and closed it without items, producing a record the
eve schema rejects (settings has minItems 1). Skip the frame instead; a
tx whose only content is an empty SETTINGS frame is then not logged at
all, matching the empty headers handling.

Exposed by the flow-end flush of IDS-dropped flows: the dropped flow in
the drop-protocol-change test carries such a frame.
This commit is contained in:
Victor Julien
2026-10-03 14:09:37 +00:00
parent bf167418bf
commit 215961d672
+5
View File
@@ -125,6 +125,11 @@ fn log_http2_frames(frames: &[HTTP2Frame], js: &mut JsonBuilder) -> Result<bool,
let mut has_settings = false;
for frame in frames {
if let HTTP2FrameTypeData::SETTINGS(set) = &frame.data {
if set.is_empty() {
/* an empty SETTINGS frame (e.g. an ACK) has no entries and
* must not open an empty settings array */
continue;
}
if !has_settings {
js.open_array("settings")?;
has_settings = true;