From 215961d67239ba2594a0d43f031829ecf710e3e9 Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Sat, 3 Oct 2026 12:54:15 +0000
Subject: [PATCH] http2: do not log an empty settings array

An empty SETTINGS frame (an ACK, or a SETTINGS without entries) opened
the settings array and closed it without items, producing a record the
eve schema rejects (settings has minItems 1). Skip the frame instead; a
tx whose only content is an empty SETTINGS frame is then not logged at
all, matching the empty headers handling.

Exposed by the flow-end flush of IDS-dropped flows: the dropped flow in
the drop-protocol-change test carries such a frame.
---
 rust/src/http2/logger.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/rust/src/http2/logger.rs b/rust/src/http2/logger.rs
index c388c4887f..ebd44bc735 100644
--- a/rust/src/http2/logger.rs
+++ b/rust/src/http2/logger.rs
@@ -125,6 +125,11 @@ fn log_http2_frames(frames: &[HTTP2Frame], js: &mut JsonBuilder) -> Result<bool,
     let mut has_settings = false;
     for frame in frames {
         if let HTTP2FrameTypeData::SETTINGS(set) = &frame.data {
+            if set.is_empty() {
+                /* an empty SETTINGS frame (e.g. an ACK) has no entries and
+                 * must not open an empty settings array */
+                continue;
+            }
             if !has_settings {
                 js.open_array("settings")?;
                 has_settings = true;