Merge r1225476:

Don't use #ifdef inside macro calls

The behavior is undefined according to C99 6.10.3.11 and it breaks with
xlc on AIX

PR: 52394

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1225477 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index 78a2bd0529f587a3e96ccb4d0362b5d8acb10365..98ba6a240ed8424fc80d69f7d15752cf4ba53803 100644 (file)
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -35,6 +35,11 @@
 **  _________________________________________________________________
 */
 
+#ifndef OPENSSL_NO_EC
+#define KEYTYPES "RSA, DSA or ECC"
+#else 
+#define KEYTYPES "RSA or DSA"
+#endif
 
 static void ssl_add_version_components(apr_pool_t *p,
                                        server_rec *s)
@@ -1135,11 +1140,7 @@ static void ssl_init_server_certs(server_rec *s,
 #endif
 )) {
         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01910)
-#ifndef OPENSSL_NO_EC
-                "Oops, no RSA, DSA or ECC server certificate found "
-#else
-                "Oops, no RSA or DSA server certificate found "
-#endif
+                "Oops, no " KEYTYPES " server certificate found "
                 "for '%s:%d'?!", s->server_hostname, s->port);
         ssl_die();
     }
@@ -1160,11 +1161,7 @@ static void ssl_init_server_certs(server_rec *s,
 #endif
           )) {
         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01911)
-#ifndef OPENSSL_NO_EC
-                "Oops, no RSA, DSA or ECC server private key found?!");
-#else
-                "Oops, no RSA or DSA server private key found?!");
-#endif
+                "Oops, no " KEYTYPES " server private key found?!");
         ssl_die();
     }
 }
@@ -1460,21 +1457,17 @@ void ssl_init_CheckServers(server_rec *base_server, apr_pool_t *p)
         klen = strlen(key);
 
         if ((ps = (server_rec *)apr_hash_get(table, key, klen))) {
-            ap_log_error(APLOG_MARK,
-#ifdef OPENSSL_NO_TLSEXT
-                         APLOG_WARNING,
-#else
-                         APLOG_DEBUG,
-#endif
-                         0,
-                         base_server,
 #ifdef OPENSSL_NO_TLSEXT
-                         "Init: SSL server IP/port conflict: "
+            int level = APLOG_WARNING;
+            const char *problem = "conflict";
 #else
-                         "Init: SSL server IP/port overlap: "
+            int level = APLOG_DEBUG;
+            const char *problem = "overlap";
 #endif
+            ap_log_error(APLOG_MARK, level, 0, base_server,
+                         "Init: SSL server IP/port %s: "
                          "%s (%s:%d) vs. %s (%s:%d)",
-                         ssl_util_vhostid(p, s),
+                         problem, ssl_util_vhostid(p, s),
                          (s->defn_name ? s->defn_name : "unknown"),
                          s->defn_line_number,
                          ssl_util_vhostid(p, ps),
@@ -1488,11 +1481,12 @@ void ssl_init_CheckServers(server_rec *base_server, apr_pool_t *p)
     }
 
     if (conflict) {
-        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01917)
 #ifdef OPENSSL_NO_TLSEXT
+        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01917)
                      "Init: You should not use name-based "
                      "virtual hosts in conjunction with SSL!!");
 #else
+        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(02292)
                      "Init: Name-based SSL virtual hosts only "
                      "work for clients with TLS server name indication "
                      "support (RFC 4366)");

diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index 45ba428050ae476155400fd7b9e1703d6ca47b8b..df4a146724689de37b71ac21fdbcab2b7ce8ce7f 100644 (file)
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -745,6 +745,7 @@ int ssl_hook_Access(request_rec *r)
             }
         }
         else {
+            const char *reneg_support;
             request_rec *id = r->main ? r->main : r;
 
             /* Additional mitigation for CVE-2009-3555: At this point,
@@ -764,17 +765,17 @@ int ssl_hook_Access(request_rec *r)
                 r->connection->keepalive = AP_CONN_CLOSE;
             }
 
+#if defined(SSL_get_secure_renegotiation_support)
+            reneg_support = SSL_get_secure_renegotiation_support(ssl) ?
+                            "client does" : "client does not";
+#else
+            reneg_support = "server does not";
+#endif
             /* Perform a full renegotiation. */
             ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02260)
                           "Performing full renegotiation: complete handshake "
                           "protocol (%s support secure renegotiation)",
-#if defined(SSL_get_secure_renegotiation_support)
-                          SSL_get_secure_renegotiation_support(ssl) ?
-                          "client does" : "client does not"
-#else
-                          "server does not"
-#endif
-                );
+                          reneg_support);
 
             SSL_set_session_id_context(ssl,
                                        (unsigned char *)&id,