Add a ZM_DB_SSL_VERIFY_SERVER_CERT setting so a database connection that uses
ZM_DB_SSL_CA_CERT can talk to a server with a self-signed or otherwise
non-matching certificate. When enabled, verification is by identity (the cert
must chain to the CA and its CN/SAN must match ZM_DB_HOST), consistent across
the C++ daemons, the PHP web interface, the CakePHP API and the Perl scripts.
This re-does the reverted #3817. That PR broke the build because it called
mysql_options(MYSQL_OPT_SSL_VERIFY_SERVER_CERT, ...), and that enum was removed
from the MySQL 8.0 C client in favour of MYSQL_OPT_SSL_MODE; it also passed a
c_str() where a my_bool* was expected, and referenced the PHP constant
unconditionally (fatal on PHP 8 for an upgraded install whose zm.conf predates
the option).
The option that controls server-cert verification differs by client library and
the symbols are enum values, not macros, so CMake feature-detects them by
compiling:
- HAVE_MYSQL_OPT_SSL_MODE (MySQL 5.7.11+/8.0, MariaDB Connector/C 3.1+)
- HAVE_MYSQL_OPT_SSL_VERIFY_SERVER_CERT (older MariaDB/MySQL)
zm_db.cpp uses SSL_MODE_VERIFY_IDENTITY / SSL_MODE_REQUIRED when the former is
available, else falls back to the latter with a proper my_bool.
Value handling is three-way in every layer: a truthy value verifies, a false-y
value (0/false/no/off) skips verification, and an empty/unset value leaves the
client default in place so existing installs are unchanged on upgrade. PHP, the
API datasource (via PDO flags) and the Perl DSN are all guarded with defined()
checks. Fresh installs default to 1.
Documents the full ZM_DB_* connection and SSL settings, including the hostname
verification gotcha when connecting by IP, in docs/userguide/configfiles.rst.
refs #3816
1. Double decrement in trailing whitespace removal loop caused skipping
of characters. The post-decrement in *temp_ptr-- = '\0' already moves
the pointer, so the extra temp_ptr-- was wrong.
2. ConfigItem copy constructor didn't copy cfg_type, cfg_value, or
accessed from the source item, leaving them uninitialized.
3. ConfigItem::Copy() used delete instead of delete[] for arrays
allocated with new[]. This is undefined behavior.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Remove calls to zmDBConnect from various places to avoid possible side-effects/double initialization.
The function should be called once from the main thread of the daemon.
Also split config loading into 2 steps: static and DB config loading. Load the static config before zmDBConnect is called so it has a chance to succeed.
With this commit a unified structure for includes is introduced.
The general rules:
* Only include what you need
* Include wherever possible in the cpp and forward-declare in the header
The includes are sorted in a local to global fashion. This means for the include order:
0. If cpp file: The corresponding h file and an empty line
1. Includes from the project sorted alphabetically
2. System/library includes sorted alphabetically
3. Conditional includes
For reference:
/home/peterke/DEV/zoneminder/build/src/zm_config.h:31:26: warning: ISO C++ forbids converting a string constant to ‘char*’ [-Wwrite-strings]
* Fix install location for config files when building to alternate directory.
With the previous code, we ended up with a directory structure like the following:
$ find /etc/zm/conf.d/
/etc/zm/conf.d/
/etc/zm/conf.d/01-system-paths.conf
/etc/zm/conf.d/conf.d
/etc/zm/conf.d/conf.d/README
/etc/zm/conf.d/conf.d/02-multiserver.conf
* Omitted README file that should have appeared in /etc/zm/conf.d
* Fix location for configs when building to alternate directory.
* Fix works, but this should go on a branch instead.
* Fix works, but this should go on a branch instead.
* Fix location for configs when building to alternate directory.
With the previous code, we ended up with a directory structure like the following:
$ find /etc/zm/conf.d/
/etc/zm/conf.d/
/etc/zm/conf.d/01-system-paths.conf
/etc/zm/conf.d/conf.d
/etc/zm/conf.d/conf.d/README
/etc/zm/conf.d/conf.d/02-multiserver.conf
* Remove double quotes. This is a list of paths.
* Allow SSL database connection to be secured with SSL.
* Fix incorrect variable name
* Fix PHP syntax errors
* SSL connection parameters must also be passed in API.
* Revert fixes to build files; they should not be in this branch.
* initial commit to migrate contents of Options->Paths to zm.conf
* remove paths items from configdata.pm
* remove paths tab from options
* update deb packaging scripts with new cmake vars
* remove extraneous file
* save custom paths variables to config file before dB is freshened
* don't check configs if the dB version is >= 1.31.0
SteveGilvarry