From: William Lallemand <wlallemand@haproxy.com>
Date: Mon, 5 Oct 2026 13:04:29 +0000 (+0000)
Subject: BUILD: ssl: avoid mixed declarations in the AWS-LC curve fetch
X-Git-Tag: v3.5-dev9~203
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=e4d1b143ba49b2364172395410f8b3da17caf9ae;p=haproxy.git

BUILD: ssl: avoid mixed declarations in the AWS-LC curve fetch

The AWS-LC API 30-34 curve fetch declares the group variable after
statements, which fails builds using -Werror=declaration-after-statement.

Move the declaration to the beginning of smp_fetch_ssl_fc_ec() and keep
the assignment in the AWS-LC branch. Mark the variable __maybe_unused
for builds using other SSL libraries.

This fix must be backported wherever commit e671cb696d ("MINOR: ssl:
support curve fetches with AWS-LC API 30") was backported.
---

diff --git a/src/ssl_sample.c b/src/ssl_sample.c
index 2a2180e62..baa6449ec 100644
--- a/src/ssl_sample.c
+++ b/src/ssl_sample.c
@@ -1736,6 +1736,7 @@ smp_fetch_ssl_fc_ec(const struct arg *args, struct sample *smp, const char *kw,
 	struct connection *conn;
 	SSL *ssl;
 	int __maybe_unused nid;
+	uint16_t __maybe_unused group;
 	char *curve_name;
 
 	if (obj_type(smp->sess->origin) == OBJ_TYPE_CHECK)
@@ -1771,7 +1772,7 @@ smp_fetch_ssl_fc_ec(const struct arg *args, struct sample *smp, const char *kw,
 			curve_name[i] = toupper((unsigned char)curve_name[i]);
 	}
 # elif defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION < 35
-	uint16_t group = SSL_get_group_id(ssl);
+	group = SSL_get_group_id(ssl);
 
 	/* Match the NIST curve short names returned by the NID-based API in
 	 * newer AWS-LC versions. Other groups, including PQ/hybrid groups,