pax_global_header 0000666 0000000 0000000 00000000064 13576374754 0014537 g ustar 00root root 0000000 0000000 52 comment=e41a84908dcb5d422bcaf2b191e8d9905b30a8d7
pg_snakeoil-1.3/ 0000775 0000000 0000000 00000000000 13576374754 0013675 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.3/.gitignore 0000664 0000000 0000000 00000000257 13576374754 0015671 0 ustar 00root root 0000000 0000000 # Generated subdirectories
/log/
/results/
/tmp_check/
*.o
*.bc
*.so
*.typedefs
regression.diffs
regression.out
debian/.debhelper/*
debian/files
debian/postgresql-*-snakeoil*
pg_snakeoil-1.3/.travis.yml 0000664 0000000 0000000 00000001460 13576374754 0016007 0 ustar 00root root 0000000 0000000 # run the testsuite on travis-ci.com
---
# versions to run on
env:
- PG_SUPPORTED_VERSIONS=9.2
- PG_SUPPORTED_VERSIONS=9.3
- PG_SUPPORTED_VERSIONS=9.4
- PG_SUPPORTED_VERSIONS=9.5
- PG_SUPPORTED_VERSIONS=9.6
- PG_SUPPORTED_VERSIONS=10
- PG_SUPPORTED_VERSIONS=11
- PG_SUPPORTED_VERSIONS=12
- PG_SUPPORTED_VERSIONS=13
language: C
dist: xenial
before_install:
- sudo apt-get update -qq
install:
# upgrade postgresql-common for new apt.postgresql.org.sh
- sudo apt-get install -y postgresql-common libclamav-dev
- sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -p -v $PG_SUPPORTED_VERSIONS -i
script:
- make
- sudo make install
- pg_virtualenv -o "pg_snakeoil.signature_dir=$PWD/testfiles" make installcheck
- if test -s regression.diffs; then cat regression.diffs; fi
pg_snakeoil-1.3/LICENSE 0000664 0000000 0000000 00000002044 13576374754 0014702 0 ustar 00root root 0000000 0000000 pg_snakeoil, The PostgreSQL Antivirus
Copyright (c) 2018-2019, Alexander Sosna
Copyright (c) 2018-2019, credativ GmbH
Permission to use, copy, modify, and distribute this software and its
documentation for any purpose, without fee, and without a written agreement
is hereby granted, provided that the above copyright notice and this
paragraph and the following two paragraphs appear in all copies.
IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE TO ANY PARTY FOR
DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS
DOCUMENTATION, EVEN IF CREDATIV HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
THE COPYRIGHT HOLDERS AND CONTRIBUTORS SPECIFICALLY DISCLAIMS ANY WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS
ON AN "AS IS" BASIS, AND CREDATIV HAS NO OBLIGATIONS TO
PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
pg_snakeoil-1.3/Makefile 0000664 0000000 0000000 00000000730 13576374754 0015335 0 ustar 00root root 0000000 0000000 # pg_snakeoil/Makefile
MODULE_big = pg_snakeoil
OBJS = pg_snakeoil.o
EXTENSION = pg_snakeoil
DATA = pg_snakeoil--0.4--1.sql \
pg_snakeoil--1.sql
PGFILEDESC = "pg_snakeoil - clamav antivirus integration"
REGRESS = pg_snakeoil
# Only works when using pgxs
PG_CONFIG = pg_config
PGXS := $(shell $(PG_CONFIG) --pgxs)
include $(PGXS)
PG_LIBS=-lclamav
SHLIB_LINK=-lclamav
typedefs:
sh gen_typedefs
pgindent:
pgindent --typedefs=$(MODULE_big).typedefs $(MODULE_big).c pg_snakeoil-1.3/README.md 0000664 0000000 0000000 00000010615 13576374754 0015157 0 ustar 00root root 0000000 0000000 # pg_snakeoil - The PostgreSQL Antivirus
Running typical on-access antivirus software on a PostgreSQL server has severe
drawbacks such as severely affecting performance or making the filesystem
unreliable. The failure modes are extremely problematic when a
non-PostgreSQL-aware scanner blocks access to a file due to viruses, or even
false-positives and bugs in the scanner software.
We typically recommend not to run such software on PostgreSQL servers, as
PostgreSQL knows how to discern between code and data and will not execute any
viruses stored in a database. However, running anti-virus software is sometimes
required by local policy.
pg_snakeoil provides ClamAV scanning of all data in PostgreSQL in a way that
does not interfere with the proper functioning of PostgreSQL and does not cause
collateral damage or unnecessary downtimes.
[](https://travis-ci.org/credativ/pg_snakeoil)
## Usage
### SQL Functions
pg_snakeoil provides SQL functions to scan given data for viruses. The
functions can be used manually or automatically, e.g. via triggers or check
constraints. The following functions are implemented:
#### so_is_infected (text) RETURNS bool
Returns true if the given data matches a signature in the virus database.
#### so_virus_name (text) RETURNS text
Returns virus name if the given data matches a signature in the virus database, empty string otherwise.
#### so_is_infected (bytea) RETURNS bool
Returns true if the given data matches a signature in the virus database.
#### so_virus_name (bytea) RETURNS text
Returns virus name if the given data matches a signature in the virus database,
NULL otherwise.
#### so_update_signatures () RETURNS bool
Update signatures, returns true if signatures changed, false otherwise.
## Installation
### Dependencies
* libclamav
* freshclam (recommended to keep signatures current)
### Compile
```bash
make PG_CONFIG=/path/to/pg_config
sudo make install
```
### Testing
In postgresql.conf, set `pg_snakeoil.signature_dir = '/path/to/pg_snakeoil.git/testfiles'`.
```bash
make installcheck
```
### Preload
pg_snakeoil is loaded by each PostgreSQL backend when needed.
An instance of the ClamAV engine is started for every new backend.
This takes several seconds for the first function call after connecting.
If backends (connections) do not persist and are only used for a single query, it might be interesting to avoid the overhead for the first function call by adding pg_snakeoil to `shared_preload_libraries` in
`postgresql.conf`:
```
shared_preload_libraries = 'pg_snakeoil'
```
When loaded this way, the ClamAV engine will use the signatures loaded while PostgreSQL was started.
Newer signatures will not be loaded automatically.
If the extension is not in `shared_preload_libraries`, new signatures will be used for new connections automatically.
The engine can also be reloaded manually with new signatures via `SELECT so_update_signatures ();`, but this only affects the current backend (connection).
### Create Extension
In each database where pg_snakeoil is to be used, execute:
```SQL
CREATE EXTENSION pg_snakeoil;
```
## Examples
### Functions
### Ad-hoc checks
```SQL
postgres=# SELECT so_is_infected('Not a virus!');
so_is_infected
----------------
f
(1 row)
postgres=# SELECT so_is_infected('X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*');
so_is_infected
----------------
t
(1 row)
postgres=# SELECT so_virus_name('X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*');
so_virus_name
----------------------
Eicar-Test-Signature
(1 row)
```
#### On Access Check
```SQL
CREATE EXTENSION pg_snakeoil;
CREATE DOMAIN safe_text AS text CHECK (NOT so_is_infected(value));
CREATE TABLE t1(safe safe_text);
INSERT INTO t1 VALUES ('This text is safe!');
INSERT
INSERT INTO t1 VALUES('X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*');
NOTICE: Virus found: Eicar-Test-Signature
ERROR: value for domain safe_text violates check constraint "safe_text_check"
```
## Future Ideas
### Scan via pg_recvlogical
`pg_recvlogical` could be used to acquire the data entering the server
instead of file system access, allowing offloading of the CPU-time
required for scanning to another server. The reaction to a positive
ClamAV result is fully customizable from asynchronous notification of
pg_snakeoil-1.3/debian/ 0000775 0000000 0000000 00000000000 13576374754 0015117 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.3/debian/changelog 0000664 0000000 0000000 00000001353 13576374754 0016773 0 ustar 00root root 0000000 0000000 pg-snakeoil (1.3-1) unstable; urgency=medium
* Make signature directory configurable via pg_snakeoil.signature_dir.
(Closes: #946359)
-- Christoph Berg Wed, 18 Dec 2019 10:42:59 +0100
pg-snakeoil (1.2-1) unstable; urgency=medium
* Upload for PostgreSQL 12.
-- Christoph Berg Tue, 29 Oct 2019 13:40:03 +0100
pg-snakeoil (1.1-1) unstable; urgency=medium
* New upstream version, fixes compatibility with clamav 0.101.
* Attribute Alexander Sosna's copyright.
-- Christoph Berg Mon, 04 Feb 2019 10:37:34 +0100
pg-snakeoil (1.0-1) unstable; urgency=medium
* Initial release.
-- Christoph Berg Mon, 28 Jan 2019 14:06:57 +0100
pg_snakeoil-1.3/debian/compat 0000664 0000000 0000000 00000000002 13576374754 0016315 0 ustar 00root root 0000000 0000000 9
pg_snakeoil-1.3/debian/control 0000664 0000000 0000000 00000001323 13576374754 0016521 0 ustar 00root root 0000000 0000000 Source: pg-snakeoil
Section: database
Priority: optional
Maintainer: Debian PostgreSQL Maintainers
Uploaders: Christoph Berg
Build-Depends:
debhelper (>= 9),
libclamav-dev,
postgresql-server-dev-all (>= 153~),
Standards-Version: 4.2.1
Vcs-Browser: https://github.com/credativ/pg_snakeoil
Vcs-Git: https://github.com/credativ/pg_snakeoil.git
Package: postgresql-12-snakeoil
Architecture: any
Depends:
postgresql-12,
${misc:Depends},
${shlibs:Depends},
Recommends:
clamav-freshclam | clamav-data,
Description: PostgreSQL anti-virus scanner based on ClamAV
pg_snakeoil provides functions scanning PostgreSQL data for viruses using the
ClamAV anti-virus engine.
pg_snakeoil-1.3/debian/control.in 0000664 0000000 0000000 00000001341 13576374754 0017126 0 ustar 00root root 0000000 0000000 Source: pg-snakeoil
Section: database
Priority: optional
Maintainer: Debian PostgreSQL Maintainers
Uploaders: Christoph Berg
Build-Depends:
debhelper (>= 9),
libclamav-dev,
postgresql-server-dev-all (>= 153~),
Standards-Version: 4.2.1
Vcs-Browser: https://github.com/credativ/pg_snakeoil
Vcs-Git: https://github.com/credativ/pg_snakeoil.git
Package: postgresql-PGVERSION-snakeoil
Architecture: any
Depends:
postgresql-PGVERSION,
${misc:Depends},
${shlibs:Depends},
Recommends:
clamav-freshclam | clamav-data,
Description: PostgreSQL anti-virus scanner based on ClamAV
pg_snakeoil provides functions scanning PostgreSQL data for viruses using the
ClamAV anti-virus engine.
pg_snakeoil-1.3/debian/copyright 0000664 0000000 0000000 00000002302 13576374754 0017047 0 ustar 00root root 0000000 0000000 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: pg_snakeoil
Source: https://github.com/credativ/pg_snakeoil
Files: *
Copyright:
Copyright (c) 2018, Alexander Sosna
Copyright (c) 2018, credativ GmbH
License: snakeoil
Permission to use, copy, modify, and distribute this software and its
documentation for any purpose, without fee, and without a written agreement
is hereby granted, provided that the above copyright notice and this
paragraph and the following two paragraphs appear in all copies.
.
IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE TO ANY PARTY FOR
DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS
DOCUMENTATION, EVEN IF CREDATIV HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
.
THE COPYRIGHT HOLDERS AND CONTRIBUTORS SPECIFICALLY DISCLAIMS ANY WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS
ON AN "AS IS" BASIS, AND CREDATIV HAS NO OBLIGATIONS TO
PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
pg_snakeoil-1.3/debian/pgversions 0000664 0000000 0000000 00000000004 13576374754 0017233 0 ustar 00root root 0000000 0000000 all
pg_snakeoil-1.3/debian/rules 0000775 0000000 0000000 00000000633 13576374754 0016201 0 ustar 00root root 0000000 0000000 #!/usr/bin/make -f
include /usr/share/postgresql-common/pgxs_debian_control.mk
override_dh_auto_build:
+pg_buildext build build-%v
override_dh_auto_test:
# nothing to do here, see debian/tests/* instead
override_dh_auto_install:
+pg_buildext install build-%v postgresql-%v-snakeoil
override_dh_installdocs:
dh_installdocs --all README.*
override_dh_auto_clean:
+pg_buildext clean build-%v
%:
dh $@
pg_snakeoil-1.3/debian/source/ 0000775 0000000 0000000 00000000000 13576374754 0016417 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.3/debian/source/format 0000664 0000000 0000000 00000000014 13576374754 0017625 0 ustar 00root root 0000000 0000000 3.0 (quilt)
pg_snakeoil-1.3/debian/source/lintian-overrides 0000664 0000000 0000000 00000000175 13576374754 0022003 0 ustar 00root root 0000000 0000000 # don't bug people uploading from @work
source: changelog-should-mention-nmu
source: source-nmu-has-incorrect-version-number
pg_snakeoil-1.3/debian/tests/ 0000775 0000000 0000000 00000000000 13576374754 0016261 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.3/debian/tests/control 0000664 0000000 0000000 00000000125 13576374754 0017662 0 ustar 00root root 0000000 0000000 Depends: @, postgresql-server-dev-all
Tests: installcheck
Restrictions: allow-stderr
pg_snakeoil-1.3/debian/tests/installcheck 0000775 0000000 0000000 00000000122 13576374754 0020646 0 ustar 00root root 0000000 0000000 #!/bin/sh
pg_buildext -o "pg_snakeoil.signature_dir=$PWD/testfiles" installcheck
pg_snakeoil-1.3/debian/watch 0000664 0000000 0000000 00000000113 13576374754 0016143 0 ustar 00root root 0000000 0000000 version=4
https://github.com/credativ/pg_snakeoil/releases .*/v(.*).tar.gz
pg_snakeoil-1.3/expected/ 0000775 0000000 0000000 00000000000 13576374754 0015476 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.3/expected/pg_snakeoil.out 0000664 0000000 0000000 00000003054 13576374754 0020524 0 ustar 00root root 0000000 0000000 CREATE EXTENSION pg_snakeoil;
-- ------------------------------------------------------------------------
-- Management Functions
-- ------------------------------------------------------------------------
SELECT so_update_signatures();
so_update_signatures
----------------------
f
(1 row)
-- ------------------------------------------------------------------------
-- Text Functions
-- ------------------------------------------------------------------------
SELECT so_is_infected('the quick brown fox jumps over the lazy dog');
so_is_infected
----------------
t
(1 row)
SELECT so_virus_name('the quick brown fox jumps over the lazy dog');
so_virus_name
--------------------------------
The Quick Brown Fox.UNOFFICIAL
(1 row)
SELECT so_is_infected('Hello World!');
so_is_infected
----------------
f
(1 row)
SELECT so_virus_name('Hello World!');
so_virus_name
---------------
(1 row)
-- ------------------------------------------------------------------------
-- bytea Functions
-- ------------------------------------------------------------------------
SELECT so_is_infected('the quick brown fox jumps over the lazy dog'::bytea);
so_is_infected
----------------
t
(1 row)
SELECT so_virus_name('the quick brown fox jumps over the lazy dog'::bytea);
so_virus_name
--------------------------------
The Quick Brown Fox.UNOFFICIAL
(1 row)
SELECT so_is_infected('Hello World!'::bytea);
so_is_infected
----------------
f
(1 row)
SELECT so_virus_name('Hello World!'::bytea);
so_virus_name
---------------
(1 row)
pg_snakeoil-1.3/gen_typedefs 0000775 0000000 0000000 00000000472 13576374754 0016302 0 ustar 00root root 0000000 0000000 #!/bin/sh
objdump -W pg_snakeoil.so |\
egrep -A3 DW_TAG_typedef |\
perl -e ' while (<>) { chomp; @flds = split;next unless (1 < @flds);\
next if $flds[0] ne "DW_AT_name" && $flds[1] ne "DW_AT_name";\
next if $flds[-1] =~ /^DW_FORM_str/;\
print $flds[-1],"\n"; }' |\
sort | uniq > pg_snakeoil.typedefs
pg_snakeoil-1.3/images/ 0000775 0000000 0000000 00000000000 13576374754 0015142 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.3/images/pg_snakeoil_logo.png 0000664 0000000 0000000 00000332300 13576374754 0021164 0 ustar 00root root 0000000 0000000 PNG
IHDR 5 | #zTXtRaw profile type exif xڭid)p
-yX8`hYS=2+2!?c.'>߃?^wݾ~|O|O_u^_}~FOaғ#?|(n|]7/?wo߹b.盛$FzzcQJoc _ߗ}Я#
?/b痵w{gv3WVI}OKe|uh,&/saސ3pws<=FS#JW#F1QK%<';cf+ݫ
:+*"y
J$|_D[_[~VzqN'C_7`xva0!_IPo1XN|)EB)qwMJgsMア@(H#4#Ms!Z, <*J/̚jڪ0jr+zms/{}8VF͍>ƘNn=z9W\iUV]m54Dz֬۰Nu7{pHO98k7|˭~ǝ??"Q_QS{_5^nApR3"s M b{9*r(절|B,7k\OqSB9}EqK|^TZS.NO?now3o[m'3YA-7bX=RYO34b ^Yf;8Pl nbZwՍinWV-onVY#G|» ѹ/)6Nm.