From: Shivani Bhardwaj Date: Tue, 20 May 2025 13:53:24 +0000 (+0530) Subject: stream: rename TriggerRawStreamReassembly X-Git-Tag: suricata-8.0.0-rc1~237 X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=35cef72b4408142461ccb79e07bf7361bc92243f;p=thirdparty%2Fsuricata.git stream: rename TriggerRawStreamReassembly The functions around TriggerRawStreamReassembly are misnomers in the current layout of the code. The functions were named appropriately when they were created as per the structural and logical layout of the code at the time. These functions in today's code are being used to track, update and trigger progress of inspection in the raw stream only. Hence, rename them to TriggerRawStreamInspection. --- diff --git a/rust/src/core.rs b/rust/src/core.rs index c52aa375c6..8c6ecc7ab0 100644 --- a/rust/src/core.rs +++ b/rust/src/core.rs @@ -99,7 +99,7 @@ pub type SCLogMessageFunc = pub type DetectEngineStateFreeFunc = extern "C" fn(state: *mut DetectEngineState); -pub type AppLayerParserTriggerRawStreamReassemblyFunc = +pub type AppLayerParserTriggerRawStreamInspectionFunc = extern "C" fn (flow: *const Flow, direction: i32); pub type AppLayerDecoderEventsSetEventRawFunc = extern "C" fn (events: *mut *mut AppLayerDecoderEvents, @@ -166,7 +166,7 @@ pub struct SuricataContext { DetectEngineStateFree: DetectEngineStateFreeFunc, AppLayerDecoderEventsSetEventRaw: AppLayerDecoderEventsSetEventRawFunc, AppLayerDecoderEventsFreeEvents: AppLayerDecoderEventsFreeEventsFunc, - pub AppLayerParserTriggerRawStreamReassembly: AppLayerParserTriggerRawStreamReassemblyFunc, + pub AppLayerParserTriggerRawStreamInspection: AppLayerParserTriggerRawStreamInspectionFunc, pub HttpRangeFreeBlock: SCHttpRangeFreeBlock, pub HTPFileCloseHandleRange: SCHTPFileCloseHandleRange, @@ -226,11 +226,11 @@ pub fn sc_generic_var_free(gvar: *mut GenericVar) } } -/// AppLayerParserTriggerRawStreamReassembly wrapper -pub fn sc_app_layer_parser_trigger_raw_stream_reassembly(flow: *const Flow, direction: i32) { +/// AppLayerParserTriggerRawStreamInspection wrapper +pub fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *const Flow, direction: i32) { unsafe { if let Some(c) = SC { - (c.AppLayerParserTriggerRawStreamReassembly)(flow, direction); + (c.AppLayerParserTriggerRawStreamInspection)(flow, direction); } } } diff --git a/rust/src/dcerpc/dcerpc.rs b/rust/src/dcerpc/dcerpc.rs index bca18f82cb..334cc776b7 100644 --- a/rust/src/dcerpc/dcerpc.rs +++ b/rust/src/dcerpc/dcerpc.rs @@ -523,7 +523,7 @@ impl DCERPCState { } tx.req_done = true; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32); } } } else if self.tc_ssn_gap && dir == Direction::ToClient { @@ -541,7 +541,7 @@ impl DCERPCState { tx.req_done = true; tx.resp_done = true; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32); } } } @@ -656,7 +656,7 @@ impl DCERPCState { tx.req_cmd = self.get_hdr_type().unwrap_or(0); tx.req_done = true; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32); } tx.frag_cnt_ts = 1; self.transactions.push_back(tx); @@ -739,7 +739,7 @@ impl DCERPCState { tx.req_done = true; tx.frag_cnt_ts = 1; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32); } } DCERPC_TYPE_RESPONSE => { @@ -754,7 +754,7 @@ impl DCERPCState { tx.resp_done = true; tx.frag_cnt_tc = 1; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32); } } _ => { @@ -951,7 +951,7 @@ impl DCERPCState { tx.resp_done = true; tx.frag_cnt_tc = 1; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32); } } DCERPC_TYPE_REQUEST => { diff --git a/rust/src/dns/dns.rs b/rust/src/dns/dns.rs index d40b89c486..3c2d2539e9 100644 --- a/rust/src/dns/dns.rs +++ b/rust/src/dns/dns.rs @@ -685,7 +685,7 @@ impl DNSState { ); if size > 0 && cur_i.len() >= size + 2 { let msg = &cur_i[2..(size + 2)]; - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32); let frame = Frame::new( flow, &stream_slice, @@ -749,7 +749,7 @@ impl DNSState { ); if size > 0 && cur_i.len() >= size + 2 { let msg = &cur_i[2..(size + 2)]; - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32); let frame = Frame::new( flow, &stream_slice, diff --git a/rust/src/enip/enip.rs b/rust/src/enip/enip.rs index 11e7a93d3f..685a071039 100644 --- a/rust/src/enip/enip.rs +++ b/rust/src/enip/enip.rs @@ -296,7 +296,7 @@ impl EnipState { tx.tx_data.set_event(EnipEvent::InvalidPdu as u8); } tx.response = Some(pdu); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); @@ -315,10 +315,10 @@ impl EnipState { } if request { tx.request = Some(pdu); - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32); } else { tx.response = Some(pdu); - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32); } self.transactions.push_back(tx); } diff --git a/rust/src/http2/http2.rs b/rust/src/http2/http2.rs index c11d195013..e11525613a 100644 --- a/rust/src/http2/http2.rs +++ b/rust/src/http2/http2.rs @@ -1282,7 +1282,7 @@ impl HTTP2State { None => panic!("no SURICATA_HTTP2_FILE_CONFIG"), } } - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32); input = &rem[hlsafe..]; } Err(Err::Incomplete(_)) => { diff --git a/rust/src/krb/krb5.rs b/rust/src/krb/krb5.rs index 38da78cc23..46f13d643f 100644 --- a/rust/src/krb/krb5.rs +++ b/rust/src/krb/krb5.rs @@ -143,7 +143,7 @@ impl KRB5State { tx.sname = kdc_req.req_body.sname; tx.etype = None; self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); @@ -166,7 +166,7 @@ impl KRB5State { tx.ticket_etype = Some(kdc_rep.ticket.enc_part.etype); tx.etype = Some(kdc_rep.enc_part.etype); self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); @@ -186,7 +186,7 @@ impl KRB5State { tx.sname = kdc_req.req_body.sname; tx.etype = None; self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); @@ -209,7 +209,7 @@ impl KRB5State { tx.sname = Some(kdc_rep.ticket.sname); tx.etype = Some(kdc_rep.enc_part.etype); self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); @@ -240,7 +240,7 @@ impl KRB5State { tx.sname = Some(error.sname); tx.error_code = Some(error.error_code); self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); diff --git a/rust/src/ldap/ldap.rs b/rust/src/ldap/ldap.rs index a820225674..4e9688e30d 100644 --- a/rust/src/ldap/ldap.rs +++ b/rust/src/ldap/ldap.rs @@ -237,7 +237,7 @@ impl LdapState { tx.complete |= tx_is_complete(&request.protocol_op, Direction::ToServer); tx.request = Some(request); self.transactions.push_back(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToServer as i32, ); @@ -308,7 +308,7 @@ impl LdapState { let tx_id = tx.id(); tx.tx_data.updated_tc = true; tx.responses.push_back(response); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); @@ -326,7 +326,7 @@ impl LdapState { tx.complete = true; tx.responses.push_back(response); self.transactions.push_back(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); @@ -342,7 +342,7 @@ impl LdapState { let tx_id = tx.id(); tx.responses.push_back(response); self.transactions.push_back(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); diff --git a/rust/src/modbus/modbus.rs b/rust/src/modbus/modbus.rs index 981602a72a..d2bc37038e 100644 --- a/rust/src/modbus/modbus.rs +++ b/rust/src/modbus/modbus.rs @@ -196,7 +196,7 @@ impl ModbusState { tx.tx_data.updated_ts = true; tx.request = Some(msg); if !flow.is_null() { - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToServer as i32, ); @@ -211,7 +211,7 @@ impl ModbusState { tx.request = Some(msg); self.transactions.push(tx); if !flow.is_null() { - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToServer as i32, ); @@ -236,7 +236,7 @@ impl ModbusState { tx.tx_data.updated_ts = true; tx.response = Some(msg); if !flow.is_null() { - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); @@ -262,7 +262,7 @@ impl ModbusState { tx.set_event(ModbusEvent::UnsolicitedResponse); self.transactions.push(tx); if !flow.is_null() { - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); diff --git a/rust/src/mqtt/mqtt.rs b/rust/src/mqtt/mqtt.rs index 617b4077c1..7760d6016b 100644 --- a/rust/src/mqtt/mqtt.rs +++ b/rust/src/mqtt/mqtt.rs @@ -406,7 +406,7 @@ impl MQTTState { } else { Direction::ToServer }; - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32); } } diff --git a/rust/src/pgsql/pgsql.rs b/rust/src/pgsql/pgsql.rs index 6c3f3fd225..14d5f09f4f 100644 --- a/rust/src/pgsql/pgsql.rs +++ b/rust/src/pgsql/pgsql.rs @@ -391,7 +391,7 @@ impl PgsqlState { /* The server won't send any responses to such requests, so transaction should be over */ tx.tx_res_state = PgsqlTxProgress::TxDone; } - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToServer as i32, ); @@ -618,7 +618,7 @@ impl PgsqlState { if Self::response_is_complete(state) { tx.tx_req_state = PgsqlTxProgress::TxDone; tx.tx_res_state = PgsqlTxProgress::TxDone; - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c index 288cd99a80..fbccea34b0 100644 --- a/src/app-layer-htp.c +++ b/src/app-layer-htp.c @@ -1471,7 +1471,7 @@ end: /* body still in progress, but due to min inspect size we need to inspect now */ StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOSERVER, depth); - AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOSERVER); + AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER); } /* after the start of the body, disable the depth logic */ } else if (tx_ud->request_body.body_inspected > 0) { @@ -1563,7 +1563,7 @@ static int HTPCallbackResponseBodyData(const htp_connp_t *connp, htp_tx_data_t * /* body still in progress, but due to min inspect size we need to inspect now */ StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOCLIENT, depth); - AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOCLIENT); + AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT); } /* after the start of the body, disable the depth logic */ } else if (tx_ud->response_body.body_inspected > 0) { @@ -1769,7 +1769,7 @@ static int HTPCallbackRequestComplete(const htp_connp_t *connp, htp_tx_t *tx) hstate->last_request_data_stamp = abs_right_edge; /* request done, do raw reassembly now to inspect state and stream * at the same time. */ - AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOSERVER); + AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER); SCReturnInt(HTP_STATUS_OK); } @@ -1818,7 +1818,7 @@ static int HTPCallbackResponseComplete(const htp_connp_t *connp, htp_tx_t *tx) /* response done, do raw reassembly now to inspect state and stream * at the same time. */ - AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOCLIENT); + AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT); /* handle HTTP CONNECT */ if (htp_tx_request_method_number(tx) == HTP_METHOD_CONNECT) { diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index 75845c4a51..42b0548b83 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -1314,7 +1314,7 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow if (!(p->option_flags & APP_LAYER_PARSER_OPT_ACCEPT_GAPS)) { SCLogDebug("app-layer parser does not accept gaps"); if (f->alstate != NULL && !FlowChangeProto(f)) { - AppLayerParserTriggerRawStreamReassembly(f, direction); + AppLayerParserTriggerRawStreamInspection(f, direction); } AppLayerIncGapErrorCounter(tv, f); goto error; @@ -1553,13 +1553,13 @@ LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto) SCReturnUInt(r); } -void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction) +void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction) { SCEnter(); SCLogDebug("f %p tcp %p direction %d", f, f ? f->protoctx : NULL, direction); if (f != NULL && f->protoctx != NULL) - StreamTcpReassembleTriggerRawReassembly(f->protoctx, direction); + StreamTcpReassembleTriggerRawInspection(f->protoctx, direction); SCReturn; } diff --git a/src/app-layer-parser.h b/src/app-layer-parser.h index 3be6d6a99a..d269c177e1 100644 --- a/src/app-layer-parser.h +++ b/src/app-layer-parser.h @@ -278,7 +278,7 @@ void AppLayerParserSetEOF(AppLayerParserState *pstate); bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate); int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto); LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto); -void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction); +void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction); void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth); uint32_t AppLayerParserGetStreamDepth(const Flow *f); void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags); diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c index 2d4b2a424f..98d1f00145 100644 --- a/src/app-layer-smtp.c +++ b/src/app-layer-smtp.c @@ -804,7 +804,7 @@ static int SMTPProcessCommandDATA( depth = (uint32_t)(smtp_config.content_inspect_min_size + (state->toserver_data_count - state->toserver_last_data_stamp)); - AppLayerParserTriggerRawStreamReassembly(f, STREAM_TOSERVER); + AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); SCLogDebug( "StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth); StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth); @@ -832,7 +832,7 @@ static int SMTPProcessCommandDATA( } depth = (uint32_t)(state->toserver_data_count - state->toserver_last_data_stamp); - AppLayerParserTriggerRawStreamReassembly(f, STREAM_TOSERVER); + AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); SCLogDebug("StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth); StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth); } diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c index 9df0999c89..5838003354 100644 --- a/src/app-layer-ssl.c +++ b/src/app-layer-ssl.c @@ -2628,7 +2628,7 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat if (ssl_state->curr_connp->bytes_processed >= ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) { SCLogDebug("record complete, trigger RAW"); - AppLayerParserTriggerRawStreamReassembly( + AppLayerParserTriggerRawStreamInspection( ssl_state->f, direction == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT); SSLParserReset(ssl_state); ValidateRecordState(ssl_state->curr_connp); diff --git a/src/rust-context.c b/src/rust-context.c index ef28c03351..226ae5c044 100644 --- a/src/rust-context.c +++ b/src/rust-context.c @@ -28,7 +28,7 @@ const SuricataContext suricata_context = { DetectEngineStateFree, AppLayerDecoderEventsSetEventRaw, AppLayerDecoderEventsFreeEvents, - AppLayerParserTriggerRawStreamReassembly, + AppLayerParserTriggerRawStreamInspection, HttpRangeFreeBlock, HTPFileCloseHandleRange, diff --git a/src/rust-context.h b/src/rust-context.h index 9aaf532953..2f9bf7b4c0 100644 --- a/src/rust-context.h +++ b/src/rust-context.h @@ -41,7 +41,7 @@ typedef struct SuricataContext_ { void (*AppLayerDecoderEventsSetEventRaw)(AppLayerDecoderEvents **, uint8_t); void (*AppLayerDecoderEventsFreeEvents)(AppLayerDecoderEvents **); - void (*AppLayerParserTriggerRawStreamReassembly)(Flow *, int direction); + void (*AppLayerParserTriggerRawStreamInspection)(Flow *, int direction); void (*HttpRangeFreeBlock)(HttpRangeContainerBlock *); bool (*HTPFileCloseHandleRange)(const StreamingBufferConfig *sbcfg, FileContainer *, diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index a1cd39563d..2c0c3ca7cc 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -2143,10 +2143,10 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx) } /** - * \brief Trigger RAW stream reassembly + * \brief Trigger RAW stream inspection * - * Used by AppLayerTriggerRawStreamReassembly to trigger RAW stream - * reassembly from the applayer, for example upon completion of a + * Used by AppLayerTriggerRawStreamInspection to trigger RAW stream + * inspection from the applayer, for example upon completion of a * HTTP request. * * It sets a flag in the stream so that the next Raw call will return @@ -2154,7 +2154,7 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx) * * \param ssn TcpSession */ -void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn, int direction) +void StreamTcpReassembleTriggerRawInspection(TcpSession *ssn, int direction) { #ifdef DEBUG BUG_ON(ssn == NULL); diff --git a/src/stream-tcp-reassemble.h b/src/stream-tcp-reassemble.h index d450a024a4..74d2c78dd3 100644 --- a/src/stream-tcp-reassemble.h +++ b/src/stream-tcp-reassemble.h @@ -120,7 +120,7 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *, TcpReassemblyThreadCtx *); void StreamTcpReturnStreamSegments(TcpStream *); void StreamTcpSegmentReturntoPool(TcpSegment *); -void StreamTcpReassembleTriggerRawReassembly(TcpSession *, int direction); +void StreamTcpReassembleTriggerRawInspection(TcpSession *, int direction); void StreamTcpPruneSession(Flow *, uint8_t); bool StreamTcpReassembleDepthReached(Packet *p);