Commit 57c62659 authored by Stefan Fritsch's avatar Stefan Fritsch
Browse files

Don't use #ifdef inside macro calls 

The behavior is undefined according to C99 6.10.3.11 and it breaks with
xlc on AIX

PR: 52394


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1225476 13f79535-47bb-0310-9956-ffa450edef68
parent 4a1f888e

docs/log-message-tags/next-number

+1 −1
Changes for docs/log-message-tags/next-number: 1 added line, 1 removed line.
Original line number Diff line number Diff line 
2292
 
2293

modules/ssl/ssl_engine_init.c

+16 −22
Changes for modules/ssl/ssl_engine_init.c: 16 added lines, 22 removed lines.
Original line number Diff line number Diff line
@@ -35,6 +35,11 @@ 
**  _________________________________________________________________

*/



#ifndef OPENSSL_NO_EC

#define KEYTYPES "RSA, DSA or ECC"

#else 

#define KEYTYPES "RSA or DSA"

#endif



static void ssl_add_version_components(apr_pool_t *p,

                                       server_rec *s)
@@ -1135,11 +1140,7 @@ static void ssl_init_server_certs(server_rec *s, 
#endif

)) {

        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01910)

#ifndef OPENSSL_NO_EC

                "Oops, no RSA, DSA or ECC server certificate found "

#else

                "Oops, no RSA or DSA server certificate found "

#endif

                "Oops, no " KEYTYPES " server certificate found "

                "for '%s:%d'?!", s->server_hostname, s->port);

        ssl_die();

    }
@@ -1160,11 +1161,7 @@ static void ssl_init_server_certs(server_rec *s, 
#endif

          )) {

        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01911)

#ifndef OPENSSL_NO_EC

                "Oops, no RSA, DSA or ECC server private key found?!");

#else

                "Oops, no RSA or DSA server private key found?!");

#endif

                "Oops, no " KEYTYPES " server private key found?!");

        ssl_die();

    }

}
@@ -1460,21 +1457,17 @@ void ssl_init_CheckServers(server_rec *base_server, apr_pool_t *p) 
        klen = strlen(key);



        if ((ps = (server_rec *)apr_hash_get(table, key, klen))) {

            ap_log_error(APLOG_MARK,

#ifdef OPENSSL_NO_TLSEXT

                         APLOG_WARNING,

#else

                         APLOG_DEBUG,

#endif

                         0,

                         base_server,

#ifdef OPENSSL_NO_TLSEXT

                         "Init: SSL server IP/port conflict: "

            int level = APLOG_WARNING;

            const char *problem = "conflict";

#else

                         "Init: SSL server IP/port overlap: "

            int level = APLOG_DEBUG;

            const char *problem = "overlap";

#endif

            ap_log_error(APLOG_MARK, level, 0, base_server,

                         "Init: SSL server IP/port %s: "

                         "%s (%s:%d) vs. %s (%s:%d)",

                         ssl_util_vhostid(p, s),

                         problem, ssl_util_vhostid(p, s),

                         (s->defn_name ? s->defn_name : "unknown"),

                         s->defn_line_number,

                         ssl_util_vhostid(p, ps),
@@ -1488,11 +1481,12 @@ void ssl_init_CheckServers(server_rec *base_server, apr_pool_t *p) 
    }



    if (conflict) {

        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01917)

#ifdef OPENSSL_NO_TLSEXT

        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01917)

                     "Init: You should not use name-based "

                     "virtual hosts in conjunction with SSL!!");

#else

        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(02292)

                     "Init: Name-based SSL virtual hosts only "

                     "work for clients with TLS server name indication "

                     "support (RFC 4366)");

modules/ssl/ssl_engine_kernel.c

+8 −7
Changes for modules/ssl/ssl_engine_kernel.c: 8 added lines, 7 removed lines.
Original line number Diff line number Diff line
@@ -745,6 +745,7 @@ int ssl_hook_Access(request_rec *r) 
            }

        }

        else {

            const char *reneg_support;

            request_rec *id = r->main ? r->main : r;



            /* Additional mitigation for CVE-2009-3555: At this point,
@@ -764,17 +765,17 @@ int ssl_hook_Access(request_rec *r) 
                r->connection->keepalive = AP_CONN_CLOSE;

            }



#if defined(SSL_get_secure_renegotiation_support)

            reneg_support = SSL_get_secure_renegotiation_support(ssl) ?

                            "client does" : "client does not";

#else

            reneg_support = "server does not";

#endif

            /* Perform a full renegotiation. */

            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02260)

                          "Performing full renegotiation: complete handshake "

                          "protocol (%s support secure renegotiation)",

#if defined(SSL_get_secure_renegotiation_support)

                          SSL_get_secure_renegotiation_support(ssl) ?

                          "client does" : "client does not"

#else

                          "server does not"

#endif

                );

                          reneg_support);



            SSL_set_session_id_context(ssl,

                                       (unsigned char *)&id,