From 82c4302a27e0f516b331b091d68e8f626290fd39 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 27 Aug 2026 14:23:37 +0200
Subject: [PATCH] http2: host normalization handles ipv6 address

And does not consider automatically a port after first colon

Ticket: 8778
(cherry picked from commit b0b353d0c01ced8b55d43a5560edf2234b7f9f05)
---
 rust/src/http2/detect.rs | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/rust/src/http2/detect.rs b/rust/src/http2/detect.rs
index d7c86cb327..fa2133d6bd 100644
--- a/rust/src/http2/detect.rs
+++ b/rust/src/http2/detect.rs
@@ -623,8 +623,18 @@ fn http2_normalize_host(ve: Http2Header) -> Http2Header {
         Some(i) => i + 1,
         None => 0,
     };
-    let end = match &vs[start..].iter().position(|&x| x == b':') {
-        Some(j) => start + j,
+    let end = match &vs[start..]
+        .iter()
+        .rev()
+        .position(|&x| x == b':' || x == b']')
+    {
+        Some(j) => {
+            if vs[vs.len() - 1 - j] == b']' {
+                vs.len()
+            } else {
+                vs.len() - 1 - j
+            }
+        }
         None => vs.len(),
     };
     return match ve {
@@ -1134,6 +1144,16 @@ mod tests {
         let buf4 = "user:pass@localhost:123".as_bytes();
         let r4 = http2_normalize_host(Http2Header::Single(buf4));
         assert_eq!(r4, Http2Header::Single("localhost".as_bytes()));
+
+        let buf5 = "[2001:db8::5]:443".as_bytes();
+        let r5 = http2_normalize_host(Http2Header::Single(buf5));
+        assert_eq!(r5, Http2Header::Single("[2001:db8::5]".as_bytes()));
+        let buf6 = "[2001:db8::5]".as_bytes();
+        let r6 = http2_normalize_host(Http2Header::Single(buf6));
+        assert_eq!(r6, Http2Header::Single("[2001:db8::5]".as_bytes()));
+        let buf7 = "user@[2001:db8::5]".as_bytes();
+        let r7 = http2_normalize_host(Http2Header::Single(buf7));
+        assert_eq!(r7, Http2Header::Single("[2001:db8::5]".as_bytes()));
     }
 
     #[test]