diff --git a/scripts/base/files/extract/main.zeek b/scripts/base/files/extract/main.zeek
index 24cdb151c9..93288c5127 100644
--- a/scripts/base/files/extract/main.zeek
+++ b/scripts/base/files/extract/main.zeek
@@ -11,15 +11,6 @@ export {
## number of bytes). A value of zero means unlimited.
option default_limit = 0;
- ## This setting configures if the file extract limit is inclusive
- ## of missing bytes. By default, missing bytes do count towards the
- ## limit.
- ## Setting this option to false changes this behavior so that missing
- ## bytes no longer count towards these limits. Files with
- ## missing bytes are created as sparse files on disk. Their apparent size
- ## can exceed this file size limit.
- option default_limit_includes_missing = T;
-
redef record Files::Info += {
## Local filename of extracted file.
extracted: string &optional &log;
@@ -46,14 +37,6 @@ export {
## :zeek:see:`FileExtract::set_limit` is called to increase the
## limit. A value of zero means "no limit".
extract_limit: count &default=default_limit;
- ## By default, missing bytes in files count towards the extract file size.
- ## Missing bytes can, e.g., occur due to missed traffic, or offsets
- ## used when downloading files.
- ## Setting this option to false changes this behavior so that holes
- ## in files do no longer count towards these limits. Files with
- ## holes are created as sparse files on disk. Their apparent size
- ## can exceed this file size limit.
- extract_limit_includes_missing: bool &default=default_limit_includes_missing;
};
## Sets the maximum allowed extracted file size.
diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc
index 069478378c..e6805b867a 100644
--- a/src/file_analysis/analyzer/extract/Extract.cc
+++ b/src/file_analysis/analyzer/extract/Extract.cc
@@ -13,10 +13,9 @@ namespace zeek::file_analysis::detail
{
Extract::Extract(RecordValPtr args, file_analysis::File* file, const std::string& arg_filename,
- uint64_t arg_limit, bool arg_limit_includes_missing)
+ uint64_t arg_limit)
: file_analysis::Analyzer(file_mgr->GetComponentTag("EXTRACT"), std::move(args), file),
- filename(arg_filename), limit(arg_limit), written(0),
- limit_includes_missing(arg_limit_includes_missing)
+ filename(arg_filename), limit(arg_limit), depth(0)
{
char buf[128];
file_stream = fopen(filename.data(), "wb");
@@ -61,25 +60,14 @@ file_analysis::Analyzer* Extract::Instantiate(RecordValPtr args, file_analysis::
{
const auto& fname = get_extract_field_val(args, "extract_filename");
const auto& limit = get_extract_field_val(args, "extract_limit");
- const auto& extract_limit_includes_missing = get_extract_field_val(
- args, "extract_limit_includes_missing");
- if ( ! fname || ! limit || ! extract_limit_includes_missing )
+ if ( ! fname || ! limit )
return nullptr;
- return new Extract(std::move(args), file, fname->AsString()->CheckString(), limit->AsCount(),
- extract_limit_includes_missing->AsBool());
+ return new Extract(std::move(args), file, fname->AsString()->CheckString(), limit->AsCount());
}
-/**
- * Check if we are exceeding the write limit with this write.
- * @param lim size limit
- * @param written how many bytes we have written so far
- * @param len length of the write
- * @param n number of bytes to write to keep within limit
- * @returns true if limit exceeded
- */
-static bool check_limit_exceeded(uint64_t lim, uint64_t written, uint64_t len, uint64_t* n)
+static bool check_limit_exceeded(uint64_t lim, uint64_t depth, uint64_t len, uint64_t* n)
{
if ( lim == 0 )
{
@@ -87,14 +75,14 @@ static bool check_limit_exceeded(uint64_t lim, uint64_t written, uint64_t len, u
return false;
}
- if ( written >= lim )
+ if ( depth >= lim )
{
*n = 0;
return true;
}
- else if ( written + len > lim )
+ else if ( depth + len > lim )
{
- *n = lim - written;
+ *n = lim - depth;
return true;
}
else
@@ -111,7 +99,7 @@ bool Extract::DeliverStream(const u_char* data, uint64_t len)
return false;
uint64_t towrite = 0;
- bool limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
+ bool limit_exceeded = check_limit_exceeded(limit, depth, len, &towrite);
if ( limit_exceeded && file_extraction_limit )
{
@@ -120,7 +108,7 @@ bool Extract::DeliverStream(const u_char* data, uint64_t len)
{f->ToVal(), GetArgs(), val_mgr->Count(limit), val_mgr->Count(len)});
// Limit may have been modified by a BIF, re-check it.
- limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
+ limit_exceeded = check_limit_exceeded(limit, depth, len, &towrite);
}
char buf[128];
@@ -136,7 +124,7 @@ bool Extract::DeliverStream(const u_char* data, uint64_t len)
return false;
}
- written += towrite;
+ depth += towrite;
}
// Assume we may not try to write anything more for a while due to reaching
@@ -157,30 +145,7 @@ bool Extract::Undelivered(uint64_t offset, uint64_t len)
if ( ! file_stream )
return false;
- if ( limit_includes_missing )
- {
- uint64_t towrite = 0;
- bool limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
- // if the limit is exceeded, we have to raise the event. This gives scripts the opportunity
- // to raise the limit.
- if ( limit_exceeded && file_extraction_limit )
- {
- file_analysis::File* f = GetFile();
- f->FileEvent(file_extraction_limit,
- {f->ToVal(), GetArgs(), val_mgr->Count(limit), val_mgr->Count(len)});
- // we have to check again if the limit is still exceedee
- limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
- }
-
- // if the limit is exceeded, abort and don't do anything - no reason to seek.
- if ( limit_exceeded )
- return false;
-
- // if we don't skip holes, count this hole against the write limit
- written += len;
- }
-
- if ( fseek(file_stream, len + offset, SEEK_SET) != 0 )
+ if ( depth == offset )
{
char* tmp = new char[len]();
@@ -196,7 +161,7 @@ bool Extract::Undelivered(uint64_t offset, uint64_t len)
}
delete[] tmp;
- written += len;
+ depth += len;
}
return true;
diff --git a/src/file_analysis/analyzer/extract/Extract.h b/src/file_analysis/analyzer/extract/Extract.h
index 60249741ce..ffe1a69e19 100644
--- a/src/file_analysis/analyzer/extract/Extract.h
+++ b/src/file_analysis/analyzer/extract/Extract.h
@@ -65,17 +65,15 @@ protected:
* @param arg_filename a file system path which specifies the local file
* to which the contents of the file will be extracted/written.
* @param arg_limit the maximum allowed file size.
- * @param arg_limit_includes_missing missing bytes count towards limit if true.
*/
Extract(RecordValPtr args, file_analysis::File* file, const std::string& arg_filename,
- uint64_t arg_limit, bool arg_limit_includes_missing);
+ uint64_t arg_limit);
private:
std::string filename;
FILE* file_stream;
- uint64_t limit; // the file extraction limit
- uint64_t written; // how many bytes we have written so far
- bool limit_includes_missing; // do count missing bytes against limit if true
+ uint64_t limit;
+ uint64_t depth;
};
} // namespace zeek::file_analysis::detail
diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output
index 986b4f35c7..d7242fc762 100644
--- a/testing/btest/Baseline/plugins.hooks/output
+++ b/testing/btest/Baseline/plugins.hooks/output
@@ -551,7 +551,6 @@
0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::max_reply_msg_length, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) ->
0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::max_user_length, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) ->
0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FileExtract::default_limit, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) ->
-0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FileExtract::default_limit_includes_missing, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) ->
0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Files::enable_reassembler, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) ->
0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (GridFTP::max_time, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) ->
0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (GridFTP::size_threshold, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) ->
@@ -2179,7 +2178,6 @@
0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::max_reply_msg_length, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100))
0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::max_user_length, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100))
0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FileExtract::default_limit, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100))
-0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FileExtract::default_limit_includes_missing, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100))
0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Files::enable_reassembler, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100))
0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (GridFTP::max_time, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100))
0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (GridFTP::size_threshold, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100))
@@ -3806,7 +3804,6 @@
0.000000 | HookCallFunction Option::set_change_handler(FTP::max_reply_msg_length, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)
0.000000 | HookCallFunction Option::set_change_handler(FTP::max_user_length, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)
0.000000 | HookCallFunction Option::set_change_handler(FileExtract::default_limit, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)
-0.000000 | HookCallFunction Option::set_change_handler(FileExtract::default_limit_includes_missing, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)
0.000000 | HookCallFunction Option::set_change_handler(Files::enable_reassembler, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)
0.000000 | HookCallFunction Option::set_change_handler(GridFTP::max_time, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)
0.000000 | HookCallFunction Option::set_change_handler(GridFTP::size_threshold, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)
diff --git a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/1.out b/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/1.out
deleted file mode 100644
index 0ef9544205..0000000000
--- a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/1.out
+++ /dev/null
@@ -1,2 +0,0 @@
-### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-file_extraction_limit, 10, 2147483648
diff --git a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/2.out b/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/2.out
deleted file mode 100644
index 49d861c74c..0000000000
--- a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/2.out
+++ /dev/null
@@ -1 +0,0 @@
-### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
diff --git a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/3.out b/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/3.out
deleted file mode 100644
index 4f3357a79c..0000000000
--- a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/3.out
+++ /dev/null
@@ -1,2 +0,0 @@
-### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-file_extraction_limit, 1, 2
diff --git a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/extract_files.1 b/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/extract_files.1
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-1.log b/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-1.log
deleted file mode 100644
index 127d2603f7..0000000000
--- a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-1.log
+++ /dev/null
@@ -1,11 +0,0 @@
-### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-#separator \x09
-#set_separator ,
-#empty_field (empty)
-#unset_field -
-#path files
-#open XXXX-XX-XX-XX-XX-XX
-#fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid extracted extracted_cutoff extracted_size
-#types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string bool count
-XXXXXXXXXX.XXXXXX Fg5gNDmaUhHwqjbp8 CHhAvVGS1DHFjwGM9 192.168.65.2 53720 91.189.91.123 80 HTTP 0 EXTRACT - - 0.000000 F F 2 5037662208 2147483648 0 T - 1 T 10
-#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-2.log b/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-2.log
deleted file mode 100644
index ffe8bed0ad..0000000000
--- a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-2.log
+++ /dev/null
@@ -1,11 +0,0 @@
-### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-#separator \x09
-#set_separator ,
-#empty_field (empty)
-#unset_field -
-#path files
-#open XXXX-XX-XX-XX-XX-XX
-#fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid extracted extracted_cutoff extracted_size
-#types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string bool count
-XXXXXXXXXX.XXXXXX Fg5gNDmaUhHwqjbp8 CHhAvVGS1DHFjwGM9 192.168.65.2 53720 91.189.91.123 80 HTTP 0 EXTRACT - - 0.000000 F F 2 5037662208 2147483648 0 T - 2 F -
-#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-3.log b/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-3.log
deleted file mode 100644
index c2d233c3ec..0000000000
--- a/testing/btest/Baseline/scripts.base.files.extract.limit-large-hole/files-3.log
+++ /dev/null
@@ -1,11 +0,0 @@
-### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-#separator \x09
-#set_separator ,
-#empty_field (empty)
-#unset_field -
-#path files
-#open XXXX-XX-XX-XX-XX-XX
-#fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid extracted extracted_cutoff extracted_size
-#types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string bool count
-XXXXXXXXXX.XXXXXX Fg5gNDmaUhHwqjbp8 CHhAvVGS1DHFjwGM9 192.168.65.2 53720 91.189.91.123 80 HTTP 0 EXTRACT - - 0.000000 F F 2 5037662208 2147483648 0 T - 3 T 1
-#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Baseline/spicy.file-analyzer-nested/output-max b/testing/btest/Baseline/spicy.file-analyzer-nested/output-max
index f973bfca9d..c7a6a03585 100644
--- a/testing/btest/Baseline/spicy.file-analyzer-nested/output-max
+++ b/testing/btest/Baseline/spicy.file-analyzer-nested/output-max
@@ -1,7 +1,7 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
data3, FyjjRu4ARLzpsPLhNh,
data3, Fz3QLf4Bn4qaQwyUdk,
-depth warning, FyjjRu4ARLzpsPLhNh, [chunk_event=, stream_event=, extract_filename=, extract_limit=0, extract_limit_includes_missing=T], 2
-depth warning, Fz3QLf4Bn4qaQwyUdk, [chunk_event=, stream_event=, extract_filename=, extract_limit=0, extract_limit_includes_missing=T], 2
+depth warning, FyjjRu4ARLzpsPLhNh, [chunk_event=, stream_event=, extract_filename=, extract_limit=0], 2
+depth warning, Fz3QLf4Bn4qaQwyUdk, [chunk_event=, stream_event=, extract_filename=, extract_limit=0], 2
data2, F2Qpmk14ATv4vFSEsi, from 1:hello world
data1, FcRmxz1fPbKQEgGGUi, hello world
diff --git a/testing/btest/Traces/http/http-large-gap.pcap b/testing/btest/Traces/http/http-large-gap.pcap
deleted file mode 100644
index 649f5305fc..0000000000
Binary files a/testing/btest/Traces/http/http-large-gap.pcap and /dev/null differ
diff --git a/testing/btest/scripts/base/files/extract/limit-large-hole.zeek b/testing/btest/scripts/base/files/extract/limit-large-hole.zeek
deleted file mode 100644
index 221e91fd73..0000000000
--- a/testing/btest/scripts/base/files/extract/limit-large-hole.zeek
+++ /dev/null
@@ -1,38 +0,0 @@
-# @TEST-EXEC: zeek -C -b -r $TRACES/http/http-large-gap.pcap %INPUT efname=1 FileExtract::default_limit_includes_missing=T
-# @TEST-EXEC: btest-diff --binary extract_files/1
-# @TEST-EXEC: btest-diff 1.out
-# @TEST-EXEC: mv files.log files-1.log
-# @TEST-EXEC: btest-diff files-1.log
-# @TEST-EXEC: zeek -C -b -r $TRACES/http/http-large-gap.pcap %INPUT efname=2 FileExtract::default_limit_includes_missing=F
-# @TEST-EXEC: rm extract_files/2
-# @TEST-EXEC: btest-diff 2.out
-# @TEST-EXEC: mv files.log files-2.log
-# @TEST-EXEC: btest-diff files-2.log
-# @TEST-EXEC: zeek -C -b -r $TRACES/http/http-large-gap.pcap %INPUT efname=3 FileExtract::default_limit_includes_missing=F max_extract=1
-# @TEST-EXEC: rm extract_files/3
-# @TEST-EXEC: btest-diff 3.out
-# @TEST-EXEC: mv files.log files-3.log
-# @TEST-EXEC: btest-diff files-3.log
-
-@load base/files/extract
-@load base/protocols/http
-
-global outfile: file;
-const max_extract: count = 10 &redef;
-const efname: string = "0" &redef;
-
-event file_new(f: fa_file)
- {
- Files::add_analyzer(f, Files::ANALYZER_EXTRACT,
- [$extract_filename=efname, $extract_limit=max_extract]);
- }
-
-event file_extraction_limit(f: fa_file, args: any, limit: count, len: count)
- {
- print outfile, "file_extraction_limit", limit, len;
- }
-
-event zeek_init()
- {
- outfile = open(fmt("%s.out", efname));
- }