From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 15 Jul 2025 12:58:49 +0000 (+0200)
Subject: http2: do not log empty objects for request or response
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=fe9da8acd6493995f53da1dcaa8ec22042196f64;p=thirdparty%2Fsuricata.git

http2: do not log empty objects for request or response

Ticket: 7741
---

diff --git a/etc/schema.json b/etc/schema.json
index 2ba472f5aa..97d5657195 100644
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -2083,6 +2083,7 @@
                         "request": {
                             "type": "object",
                             "additionalProperties": false,
+                            "minProperties": 1,
                             "properties": {
                                 "error_code": {
                                     "type": "string"
@@ -2114,6 +2115,7 @@
                         "response": {
                             "type": "object",
                             "additionalProperties": false,
+                            "minProperties": 1,
                             "properties": {
                                 "error_code": {
                                     "type": "string"
diff --git a/rust/src/http2/logger.rs b/rust/src/http2/logger.rs
index c231f599e4..2197d7a83e 100644
--- a/rust/src/http2/logger.rs
+++ b/rust/src/http2/logger.rs
@@ -270,13 +270,23 @@ fn log_http2(tx: &HTTP2Transaction, js: &mut JsonBuilder) -> Result<bool, JsonEr
     js.open_object("http2")?;
 
     js.set_uint("stream_id", tx.stream_id as u64)?;
+    let mark = js.get_mark();
     js.open_object("request")?;
     let has_request = log_http2_frames(&tx.frames_ts, js)?;
-    js.close()?;
+    if has_request {
+        js.close()?;
+    } else {
+        js.restore_mark(&mark)?;
+    }
 
+    let mark = js.get_mark();
     js.open_object("response")?;
     let has_response = log_http2_frames(&tx.frames_tc, js)?;
-    js.close()?;
+    if has_response {
+        js.close()?;
+    } else {
+        js.restore_mark(&mark)?;
+    }
 
     js.close()?; // http2
     js.close()?; // http