mirror of
https://github.com/OISF/suricata.git
synced 2026-10-12 02:07:10 +00:00
http2: do not log an empty settings array
An empty SETTINGS frame (an ACK, or a SETTINGS without entries) opened the settings array and closed it without items, producing a record the eve schema rejects (settings has minItems 1). Skip the frame instead; a tx whose only content is an empty SETTINGS frame is then not logged at all, matching the empty headers handling. Exposed by the flow-end flush of IDS-dropped flows: the dropped flow in the drop-protocol-change test carries such a frame.
This commit is contained in:
@@ -125,6 +125,11 @@ fn log_http2_frames(frames: &[HTTP2Frame], js: &mut JsonBuilder) -> Result<bool,
|
||||
let mut has_settings = false;
|
||||
for frame in frames {
|
||||
if let HTTP2FrameTypeData::SETTINGS(set) = &frame.data {
|
||||
if set.is_empty() {
|
||||
/* an empty SETTINGS frame (e.g. an ACK) has no entries and
|
||||
* must not open an empty settings array */
|
||||
continue;
|
||||
}
|
||||
if !has_settings {
|
||||
js.open_array("settings")?;
|
||||
has_settings = true;
|
||||
|
||||
Reference in New Issue
Block a user