Hide public symbols in libcrypto/x509 .c files

ok tb@

3 files changed, 724 insertions, 0 deletions

diff --git a/src/lib/libcrypto/hidden/openssl/x509.h b/src/lib/libcrypto/hidden/openssl/x509.h
new file mode 100644
index 0000000000..59af41f917
--- /dev/null
+++ b/src/lib/libcrypto/hidden/openssl/x509.h
@@ -0,0 +1,278 @@
+/* $OpenBSD: x509.h,v 1.1 2022/11/14 17:48:49 beck Exp $ */
+/*
+ * Copyright (c) 2022 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_X509_H
+#define _LIBCRYPTO_X509_H
+
+#include_next <openssl/x509.h>
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(X509_CRL_up_ref);
+LCRYPTO_USED(i2d_re_X509_CRL_tbs);
+LCRYPTO_USED(X509_get_X509_PUBKEY);
+LCRYPTO_USED(X509_verify_cert_error_string);
+LCRYPTO_USED(X509_verify);
+LCRYPTO_USED(X509_REQ_verify);
+LCRYPTO_USED(NETSCAPE_SPKI_verify);
+LCRYPTO_USED(NETSCAPE_SPKI_b64_decode);
+LCRYPTO_USED(NETSCAPE_SPKI_b64_encode);
+LCRYPTO_USED(NETSCAPE_SPKI_get_pubkey);
+LCRYPTO_USED(NETSCAPE_SPKI_set_pubkey);
+LCRYPTO_USED(X509_sign);
+LCRYPTO_USED(X509_sign_ctx);
+LCRYPTO_USED(X509_REQ_sign);
+LCRYPTO_USED(X509_REQ_sign_ctx);
+LCRYPTO_USED(X509_CRL_sign);
+LCRYPTO_USED(X509_CRL_sign_ctx);
+LCRYPTO_USED(NETSCAPE_SPKI_sign);
+LCRYPTO_USED(X509_pubkey_digest);
+LCRYPTO_USED(X509_digest);
+LCRYPTO_USED(X509_CRL_digest);
+LCRYPTO_USED(X509_REQ_digest);
+LCRYPTO_USED(X509_NAME_digest);
+LCRYPTO_USED(d2i_X509_fp);
+LCRYPTO_USED(i2d_X509_fp);
+LCRYPTO_USED(d2i_X509_CRL_fp);
+LCRYPTO_USED(i2d_X509_CRL_fp);
+LCRYPTO_USED(d2i_X509_REQ_fp);
+LCRYPTO_USED(i2d_X509_REQ_fp);
+LCRYPTO_USED(d2i_RSAPrivateKey_fp);
+LCRYPTO_USED(i2d_RSAPrivateKey_fp);
+LCRYPTO_USED(d2i_RSAPublicKey_fp);
+LCRYPTO_USED(i2d_RSAPublicKey_fp);
+LCRYPTO_USED(d2i_DSAPrivateKey_fp);
+LCRYPTO_USED(i2d_DSAPrivateKey_fp);
+LCRYPTO_USED(d2i_ECPrivateKey_fp);
+LCRYPTO_USED(i2d_ECPrivateKey_fp);
+LCRYPTO_USED(d2i_PKCS8_fp);
+LCRYPTO_USED(i2d_PKCS8_fp);
+LCRYPTO_USED(d2i_PKCS8_PRIV_KEY_INFO_fp);
+LCRYPTO_USED(i2d_PKCS8_PRIV_KEY_INFO_fp);
+LCRYPTO_USED(i2d_PKCS8PrivateKeyInfo_fp);
+LCRYPTO_USED(i2d_PrivateKey_fp);
+LCRYPTO_USED(d2i_PrivateKey_fp);
+LCRYPTO_USED(d2i_X509_bio);
+LCRYPTO_USED(i2d_X509_bio);
+LCRYPTO_USED(d2i_X509_CRL_bio);
+LCRYPTO_USED(i2d_X509_CRL_bio);
+LCRYPTO_USED(d2i_X509_REQ_bio);
+LCRYPTO_USED(i2d_X509_REQ_bio);
+LCRYPTO_USED(d2i_RSAPrivateKey_bio);
+LCRYPTO_USED(i2d_RSAPrivateKey_bio);
+LCRYPTO_USED(d2i_RSAPublicKey_bio);
+LCRYPTO_USED(i2d_RSAPublicKey_bio);
+LCRYPTO_USED(d2i_DSAPrivateKey_bio);
+LCRYPTO_USED(i2d_DSAPrivateKey_bio);
+LCRYPTO_USED(d2i_ECPrivateKey_bio);
+LCRYPTO_USED(i2d_ECPrivateKey_bio);
+LCRYPTO_USED(d2i_PKCS8_bio);
+LCRYPTO_USED(i2d_PKCS8_bio);
+LCRYPTO_USED(d2i_PKCS8_PRIV_KEY_INFO_bio);
+LCRYPTO_USED(i2d_PKCS8_PRIV_KEY_INFO_bio);
+LCRYPTO_USED(i2d_PKCS8PrivateKeyInfo_bio);
+LCRYPTO_USED(i2d_PrivateKey_bio);
+LCRYPTO_USED(d2i_PrivateKey_bio);
+LCRYPTO_USED(X509_cmp_time);
+LCRYPTO_USED(X509_cmp_current_time);
+LCRYPTO_USED(X509_time_adj);
+LCRYPTO_USED(X509_time_adj_ex);
+LCRYPTO_USED(X509_gmtime_adj);
+LCRYPTO_USED(X509_get_default_cert_area);
+LCRYPTO_USED(X509_get_default_cert_dir);
+LCRYPTO_USED(X509_get_default_cert_file);
+LCRYPTO_USED(X509_get_default_cert_dir_env);
+LCRYPTO_USED(X509_get_default_cert_file_env);
+LCRYPTO_USED(X509_get_default_private_dir);
+LCRYPTO_USED(X509_to_X509_REQ);
+LCRYPTO_USED(X509_REQ_to_X509);
+LCRYPTO_USED(X509_get_pubkey_parameters);
+LCRYPTO_USED(X509_TRUST_set_default);
+LCRYPTO_USED(X509_TRUST_set);
+LCRYPTO_USED(X509_NAME_oneline);
+LCRYPTO_USED(X509_get0_extensions);
+LCRYPTO_USED(X509_get0_tbs_sigalg);
+LCRYPTO_USED(X509_set_version);
+LCRYPTO_USED(X509_get_version);
+LCRYPTO_USED(X509_set_serialNumber);
+LCRYPTO_USED(X509_get_serialNumber);
+LCRYPTO_USED(X509_get0_serialNumber);
+LCRYPTO_USED(X509_set_issuer_name);
+LCRYPTO_USED(X509_get_issuer_name);
+LCRYPTO_USED(X509_set_subject_name);
+LCRYPTO_USED(X509_get_subject_name);
+LCRYPTO_USED(X509_set_notBefore);
+LCRYPTO_USED(X509_set1_notBefore);
+LCRYPTO_USED(X509_set_notAfter);
+LCRYPTO_USED(X509_set1_notAfter);
+LCRYPTO_USED(X509_get0_notBefore);
+LCRYPTO_USED(X509_getm_notBefore);
+LCRYPTO_USED(X509_get0_notAfter);
+LCRYPTO_USED(X509_getm_notAfter);
+LCRYPTO_USED(X509_set_pubkey);
+LCRYPTO_USED(X509_get_pubkey);
+LCRYPTO_USED(X509_get0_pubkey);
+LCRYPTO_USED(X509_get0_pubkey_bitstr);
+LCRYPTO_USED(X509_certificate_type);
+LCRYPTO_USED(X509_get_signature_type);
+LCRYPTO_USED(X509_REQ_set_version);
+LCRYPTO_USED(X509_REQ_get_version);
+LCRYPTO_USED(X509_REQ_set_subject_name);
+LCRYPTO_USED(X509_REQ_get_subject_name);
+LCRYPTO_USED(X509_REQ_set_pubkey);
+LCRYPTO_USED(X509_REQ_get_pubkey);
+LCRYPTO_USED(i2d_re_X509_REQ_tbs);
+LCRYPTO_USED(X509_REQ_get0_pubkey);
+LCRYPTO_USED(X509_REQ_extension_nid);
+LCRYPTO_USED(X509_REQ_get_extension_nids);
+LCRYPTO_USED(X509_REQ_set_extension_nids);
+LCRYPTO_USED(X509_REQ_get_extensions);
+LCRYPTO_USED(X509_REQ_add_extensions_nid);
+LCRYPTO_USED(X509_REQ_add_extensions);
+LCRYPTO_USED(X509_REQ_get_attr_count);
+LCRYPTO_USED(X509_REQ_get_attr_by_NID);
+LCRYPTO_USED(X509_REQ_get_attr_by_OBJ);
+LCRYPTO_USED(X509_REQ_get_attr);
+LCRYPTO_USED(X509_REQ_delete_attr);
+LCRYPTO_USED(X509_REQ_add1_attr);
+LCRYPTO_USED(X509_REQ_add1_attr_by_OBJ);
+LCRYPTO_USED(X509_REQ_add1_attr_by_NID);
+LCRYPTO_USED(X509_REQ_add1_attr_by_txt);
+LCRYPTO_USED(X509_CRL_set_version);
+LCRYPTO_USED(X509_CRL_set_issuer_name);
+LCRYPTO_USED(X509_CRL_set_lastUpdate);
+LCRYPTO_USED(X509_CRL_set1_lastUpdate);
+LCRYPTO_USED(X509_CRL_set_nextUpdate);
+LCRYPTO_USED(X509_CRL_set1_nextUpdate);
+LCRYPTO_USED(X509_CRL_sort);
+LCRYPTO_USED(X509_REVOKED_get0_extensions);
+LCRYPTO_USED(X509_REVOKED_get0_revocationDate);
+LCRYPTO_USED(X509_REVOKED_get0_serialNumber);
+LCRYPTO_USED(X509_REVOKED_set_revocationDate);
+LCRYPTO_USED(X509_REVOKED_set_serialNumber);
+LCRYPTO_USED(X509_REQ_check_private_key);
+LCRYPTO_USED(X509_check_private_key);
+LCRYPTO_USED(X509_issuer_and_serial_cmp);
+LCRYPTO_USED(X509_issuer_and_serial_hash);
+LCRYPTO_USED(X509_issuer_name_cmp);
+LCRYPTO_USED(X509_issuer_name_hash);
+LCRYPTO_USED(X509_subject_name_cmp);
+LCRYPTO_USED(X509_subject_name_hash);
+LCRYPTO_USED(X509_issuer_name_hash_old);
+LCRYPTO_USED(X509_subject_name_hash_old);
+LCRYPTO_USED(X509_cmp);
+LCRYPTO_USED(X509_NAME_cmp);
+LCRYPTO_USED(X509_NAME_hash);
+LCRYPTO_USED(X509_NAME_hash_old);
+LCRYPTO_USED(X509_CRL_cmp);
+LCRYPTO_USED(X509_CRL_match);
+LCRYPTO_USED(X509_NAME_entry_count);
+LCRYPTO_USED(X509_NAME_get_text_by_NID);
+LCRYPTO_USED(X509_NAME_get_text_by_OBJ);
+LCRYPTO_USED(X509_NAME_get_index_by_NID);
+LCRYPTO_USED(X509_NAME_get_index_by_OBJ);
+LCRYPTO_USED(X509_NAME_get_entry);
+LCRYPTO_USED(X509_NAME_delete_entry);
+LCRYPTO_USED(X509_NAME_add_entry);
+LCRYPTO_USED(X509_NAME_add_entry_by_OBJ);
+LCRYPTO_USED(X509_NAME_add_entry_by_NID);
+LCRYPTO_USED(X509_NAME_ENTRY_create_by_txt);
+LCRYPTO_USED(X509_NAME_ENTRY_create_by_NID);
+LCRYPTO_USED(X509_NAME_add_entry_by_txt);
+LCRYPTO_USED(X509_NAME_ENTRY_create_by_OBJ);
+LCRYPTO_USED(X509_NAME_ENTRY_set_object);
+LCRYPTO_USED(X509_NAME_ENTRY_set_data);
+LCRYPTO_USED(X509_NAME_ENTRY_get_object);
+LCRYPTO_USED(X509_NAME_ENTRY_get_data);
+LCRYPTO_USED(X509_NAME_ENTRY_set);
+LCRYPTO_USED(X509v3_get_ext_count);
+LCRYPTO_USED(X509v3_get_ext_by_NID);
+LCRYPTO_USED(X509v3_get_ext_by_OBJ);
+LCRYPTO_USED(X509v3_get_ext_by_critical);
+LCRYPTO_USED(X509v3_get_ext);
+LCRYPTO_USED(X509v3_delete_ext);
+LCRYPTO_USED(X509v3_add_ext);
+LCRYPTO_USED(X509_get_ext_count);
+LCRYPTO_USED(X509_get_ext_by_NID);
+LCRYPTO_USED(X509_get_ext_by_OBJ);
+LCRYPTO_USED(X509_get_ext_by_critical);
+LCRYPTO_USED(X509_get_ext);
+LCRYPTO_USED(X509_delete_ext);
+LCRYPTO_USED(X509_add_ext);
+LCRYPTO_USED(X509_get_ext_d2i);
+LCRYPTO_USED(X509_add1_ext_i2d);
+LCRYPTO_USED(X509_CRL_get_ext_count);
+LCRYPTO_USED(X509_CRL_get_ext_by_NID);
+LCRYPTO_USED(X509_CRL_get_ext_by_OBJ);
+LCRYPTO_USED(X509_CRL_get_ext_by_critical);
+LCRYPTO_USED(X509_CRL_get_ext);
+LCRYPTO_USED(X509_CRL_delete_ext);
+LCRYPTO_USED(X509_CRL_add_ext);
+LCRYPTO_USED(X509_CRL_get_ext_d2i);
+LCRYPTO_USED(X509_CRL_add1_ext_i2d);
+LCRYPTO_USED(X509_REVOKED_get_ext_count);
+LCRYPTO_USED(X509_REVOKED_get_ext_by_NID);
+LCRYPTO_USED(X509_REVOKED_get_ext_by_OBJ);
+LCRYPTO_USED(X509_REVOKED_get_ext_by_critical);
+LCRYPTO_USED(X509_REVOKED_get_ext);
+LCRYPTO_USED(X509_REVOKED_delete_ext);
+LCRYPTO_USED(X509_REVOKED_add_ext);
+LCRYPTO_USED(X509_REVOKED_get_ext_d2i);
+LCRYPTO_USED(X509_REVOKED_add1_ext_i2d);
+LCRYPTO_USED(X509_EXTENSION_create_by_NID);
+LCRYPTO_USED(X509_EXTENSION_create_by_OBJ);
+LCRYPTO_USED(X509_EXTENSION_set_object);
+LCRYPTO_USED(X509_EXTENSION_set_critical);
+LCRYPTO_USED(X509_EXTENSION_set_data);
+LCRYPTO_USED(X509_EXTENSION_get_object);
+LCRYPTO_USED(X509_EXTENSION_get_data);
+LCRYPTO_USED(X509_EXTENSION_get_critical);
+LCRYPTO_USED(X509at_get_attr_count);
+LCRYPTO_USED(X509at_get_attr_by_NID);
+LCRYPTO_USED(X509at_get_attr_by_OBJ);
+LCRYPTO_USED(X509at_get_attr);
+LCRYPTO_USED(X509at_delete_attr);
+LCRYPTO_USED(X509at_add1_attr);
+LCRYPTO_USED(X509at_add1_attr_by_OBJ);
+LCRYPTO_USED(X509at_add1_attr_by_NID);
+LCRYPTO_USED(X509at_add1_attr_by_txt);
+LCRYPTO_USED(X509at_get0_data_by_OBJ);
+LCRYPTO_USED(X509_ATTRIBUTE_create_by_NID);
+LCRYPTO_USED(X509_ATTRIBUTE_create_by_OBJ);
+LCRYPTO_USED(X509_ATTRIBUTE_create_by_txt);
+LCRYPTO_USED(X509_ATTRIBUTE_set1_object);
+LCRYPTO_USED(X509_ATTRIBUTE_set1_data);
+LCRYPTO_USED(X509_ATTRIBUTE_get0_data);
+LCRYPTO_USED(X509_ATTRIBUTE_count);
+LCRYPTO_USED(X509_ATTRIBUTE_get0_object);
+LCRYPTO_USED(X509_ATTRIBUTE_get0_type);
+LCRYPTO_USED(X509_verify_cert);
+LCRYPTO_USED(X509_find_by_issuer_and_serial);
+LCRYPTO_USED(X509_find_by_subject);
+LCRYPTO_USED(X509_check_trust);
+LCRYPTO_USED(X509_TRUST_get_count);
+LCRYPTO_USED(X509_TRUST_get0);
+LCRYPTO_USED(X509_TRUST_get_by_id);
+LCRYPTO_USED(X509_TRUST_add);
+LCRYPTO_USED(X509_TRUST_cleanup);
+LCRYPTO_USED(X509_TRUST_get_flags);
+LCRYPTO_USED(X509_TRUST_get0_name);
+LCRYPTO_USED(X509_TRUST_get_trust);
+LCRYPTO_USED(X509_up_ref);
+LCRYPTO_USED(X509_chain_up_ref);
+LCRYPTO_USED(ERR_load_X509_strings);
+
+#endif /* _LIBCRYPTO_X509_H */
diff --git a/src/lib/libcrypto/hidden/openssl/x509_vfy.h b/src/lib/libcrypto/hidden/openssl/x509_vfy.h
new file mode 100644
index 0000000000..3a52206b45
--- /dev/null
+++ b/src/lib/libcrypto/hidden/openssl/x509_vfy.h
@@ -0,0 +1,162 @@
+/* $OpenBSD: x509_vfy.h,v 1.1 2022/11/14 17:48:49 beck Exp $ */
+/*
+ * Copyright (c) 2022 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_X509_VFY_H
+#define _LIBCRYPTO_X509_VFY_H
+
+#include_next <openssl/x509_vfy.h>
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(X509_STORE_set_depth);
+LCRYPTO_USED(X509_STORE_CTX_set_depth);
+LCRYPTO_USED(X509_OBJECT_new);
+LCRYPTO_USED(X509_OBJECT_free);
+LCRYPTO_USED(X509_OBJECT_idx_by_subject);
+LCRYPTO_USED(X509_OBJECT_retrieve_by_subject);
+LCRYPTO_USED(X509_OBJECT_retrieve_match);
+LCRYPTO_USED(X509_OBJECT_up_ref_count);
+LCRYPTO_USED(X509_OBJECT_get_type);
+LCRYPTO_USED(X509_OBJECT_get0_X509);
+LCRYPTO_USED(X509_OBJECT_get0_X509_CRL);
+LCRYPTO_USED(X509_STORE_new);
+LCRYPTO_USED(X509_STORE_free);
+LCRYPTO_USED(X509_STORE_up_ref);
+LCRYPTO_USED(X509_STORE_get1_certs);
+LCRYPTO_USED(X509_STORE_get1_crls);
+LCRYPTO_USED(X509_STORE_get0_objects);
+LCRYPTO_USED(X509_STORE_get_ex_data);
+LCRYPTO_USED(X509_STORE_set_ex_data);
+LCRYPTO_USED(X509_STORE_set_flags);
+LCRYPTO_USED(X509_STORE_set_purpose);
+LCRYPTO_USED(X509_STORE_set_trust);
+LCRYPTO_USED(X509_STORE_set1_param);
+LCRYPTO_USED(X509_STORE_get0_param);
+LCRYPTO_USED(X509_STORE_get_verify_cb);
+LCRYPTO_USED(X509_STORE_set_verify_cb);
+LCRYPTO_USED(X509_STORE_CTX_new);
+LCRYPTO_USED(X509_STORE_CTX_get1_issuer);
+LCRYPTO_USED(X509_STORE_CTX_free);
+LCRYPTO_USED(X509_STORE_CTX_init);
+LCRYPTO_USED(X509_STORE_CTX_get0_cert);
+LCRYPTO_USED(X509_STORE_CTX_get0_chain);
+LCRYPTO_USED(X509_STORE_CTX_get0_store);
+LCRYPTO_USED(X509_STORE_CTX_get0_untrusted);
+LCRYPTO_USED(X509_STORE_CTX_set0_untrusted);
+LCRYPTO_USED(X509_STORE_CTX_trusted_stack);
+LCRYPTO_USED(X509_STORE_CTX_set0_trusted_stack);
+LCRYPTO_USED(X509_STORE_CTX_cleanup);
+LCRYPTO_USED(X509_STORE_add_lookup);
+LCRYPTO_USED(X509_LOOKUP_hash_dir);
+LCRYPTO_USED(X509_LOOKUP_file);
+LCRYPTO_USED(X509_LOOKUP_mem);
+LCRYPTO_USED(X509_STORE_add_cert);
+LCRYPTO_USED(X509_STORE_add_crl);
+LCRYPTO_USED(X509_STORE_CTX_get_by_subject);
+LCRYPTO_USED(X509_STORE_CTX_get_obj_by_subject);
+LCRYPTO_USED(X509_LOOKUP_ctrl);
+LCRYPTO_USED(X509_load_cert_file);
+LCRYPTO_USED(X509_load_crl_file);
+LCRYPTO_USED(X509_load_cert_crl_file);
+LCRYPTO_USED(X509_LOOKUP_new);
+LCRYPTO_USED(X509_LOOKUP_free);
+LCRYPTO_USED(X509_LOOKUP_init);
+LCRYPTO_USED(X509_LOOKUP_by_subject);
+LCRYPTO_USED(X509_LOOKUP_by_issuer_serial);
+LCRYPTO_USED(X509_LOOKUP_by_fingerprint);
+LCRYPTO_USED(X509_LOOKUP_by_alias);
+LCRYPTO_USED(X509_LOOKUP_shutdown);
+LCRYPTO_USED(X509_STORE_load_locations);
+LCRYPTO_USED(X509_STORE_load_mem);
+LCRYPTO_USED(X509_STORE_set_default_paths);
+LCRYPTO_USED(X509_STORE_CTX_get_ex_new_index);
+LCRYPTO_USED(X509_STORE_CTX_set_ex_data);
+LCRYPTO_USED(X509_STORE_CTX_get_ex_data);
+LCRYPTO_USED(X509_STORE_CTX_get_error);
+LCRYPTO_USED(X509_STORE_CTX_set_error);
+LCRYPTO_USED(X509_STORE_CTX_get_error_depth);
+LCRYPTO_USED(X509_STORE_CTX_set_error_depth);
+LCRYPTO_USED(X509_STORE_CTX_get_current_cert);
+LCRYPTO_USED(X509_STORE_CTX_set_current_cert);
+LCRYPTO_USED(X509_STORE_CTX_get0_current_issuer);
+LCRYPTO_USED(X509_STORE_CTX_get0_current_crl);
+LCRYPTO_USED(X509_STORE_CTX_get0_parent_ctx);
+LCRYPTO_USED(X509_STORE_CTX_get_chain);
+LCRYPTO_USED(X509_STORE_CTX_get1_chain);
+LCRYPTO_USED(X509_STORE_CTX_set_cert);
+LCRYPTO_USED(X509_STORE_CTX_set_chain);
+LCRYPTO_USED(X509_STORE_CTX_set0_crls);
+LCRYPTO_USED(X509_STORE_CTX_set_purpose);
+LCRYPTO_USED(X509_STORE_CTX_set_trust);
+LCRYPTO_USED(X509_STORE_CTX_purpose_inherit);
+LCRYPTO_USED(X509_STORE_CTX_set_flags);
+LCRYPTO_USED(X509_STORE_CTX_set_time);
+LCRYPTO_USED(X509_STORE_CTX_set0_verified_chain);
+LCRYPTO_USED(X509_STORE_CTX_get_verify);
+LCRYPTO_USED(X509_STORE_CTX_set_verify);
+LCRYPTO_USED(X509_STORE_CTX_get_verify_cb);
+LCRYPTO_USED(X509_STORE_CTX_set_verify_cb);
+LCRYPTO_USED(X509_STORE_set_verify);
+LCRYPTO_USED(X509_STORE_get_verify);
+LCRYPTO_USED(X509_STORE_CTX_get0_policy_tree);
+LCRYPTO_USED(X509_STORE_CTX_get_explicit_policy);
+LCRYPTO_USED(X509_STORE_CTX_get_num_untrusted);
+LCRYPTO_USED(X509_STORE_CTX_get0_param);
+LCRYPTO_USED(X509_STORE_CTX_set0_param);
+LCRYPTO_USED(X509_STORE_CTX_set_default);
+LCRYPTO_USED(X509_VERIFY_PARAM_new);
+LCRYPTO_USED(X509_VERIFY_PARAM_free);
+LCRYPTO_USED(X509_VERIFY_PARAM_inherit);
+LCRYPTO_USED(X509_VERIFY_PARAM_set1);
+LCRYPTO_USED(X509_VERIFY_PARAM_set1_name);
+LCRYPTO_USED(X509_VERIFY_PARAM_set_flags);
+LCRYPTO_USED(X509_VERIFY_PARAM_clear_flags);
+LCRYPTO_USED(X509_VERIFY_PARAM_get_flags);
+LCRYPTO_USED(X509_VERIFY_PARAM_set_purpose);
+LCRYPTO_USED(X509_VERIFY_PARAM_set_trust);
+LCRYPTO_USED(X509_VERIFY_PARAM_set_depth);
+LCRYPTO_USED(X509_VERIFY_PARAM_set_auth_level);
+LCRYPTO_USED(X509_VERIFY_PARAM_get_time);
+LCRYPTO_USED(X509_VERIFY_PARAM_set_time);
+LCRYPTO_USED(X509_VERIFY_PARAM_add0_policy);
+LCRYPTO_USED(X509_VERIFY_PARAM_set1_policies);
+LCRYPTO_USED(X509_VERIFY_PARAM_get_depth);
+LCRYPTO_USED(X509_VERIFY_PARAM_set1_host);
+LCRYPTO_USED(X509_VERIFY_PARAM_add1_host);
+LCRYPTO_USED(X509_VERIFY_PARAM_set_hostflags);
+LCRYPTO_USED(X509_VERIFY_PARAM_get0_peername);
+LCRYPTO_USED(X509_VERIFY_PARAM_set1_email);
+LCRYPTO_USED(X509_VERIFY_PARAM_set1_ip);
+LCRYPTO_USED(X509_VERIFY_PARAM_set1_ip_asc);
+LCRYPTO_USED(X509_VERIFY_PARAM_get0_name);
+LCRYPTO_USED(X509_VERIFY_PARAM_get0);
+LCRYPTO_USED(X509_VERIFY_PARAM_get_count);
+LCRYPTO_USED(X509_VERIFY_PARAM_add0_table);
+LCRYPTO_USED(X509_VERIFY_PARAM_lookup);
+LCRYPTO_USED(X509_VERIFY_PARAM_table_cleanup);
+LCRYPTO_USED(X509_policy_check);
+LCRYPTO_USED(X509_policy_tree_free);
+LCRYPTO_USED(X509_policy_tree_level_count);
+LCRYPTO_USED(X509_policy_tree_get0_level);
+LCRYPTO_USED(X509_policy_tree_get0_policies);
+LCRYPTO_USED(X509_policy_tree_get0_user_policies);
+LCRYPTO_USED(X509_policy_level_node_count);
+LCRYPTO_USED(X509_policy_level_get0_node);
+LCRYPTO_USED(X509_policy_node_get0_policy);
+LCRYPTO_USED(X509_policy_node_get0_qualifiers);
+LCRYPTO_USED(X509_policy_node_get0_parent);
+
+#endif /* _LIBCRYPTO_X509_VFY_H */
diff --git a/src/lib/libcrypto/hidden/openssl/x509v3.h b/src/lib/libcrypto/hidden/openssl/x509v3.h
new file mode 100644
index 0000000000..eed75e0749
--- /dev/null
+++ b/src/lib/libcrypto/hidden/openssl/x509v3.h
@@ -0,0 +1,284 @@
+/* $OpenBSD: x509v3.h,v 1.1 2022/11/14 17:48:49 beck Exp $ */
+/*
+ * Copyright (c) 2022 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_X509V3_H
+#define _LIBCRYPTO_X509V3_H
+
+#include_next <openssl/x509v3.h>
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(PROXY_POLICY_new);
+LCRYPTO_USED(PROXY_POLICY_free);
+LCRYPTO_USED(d2i_PROXY_POLICY);
+LCRYPTO_USED(i2d_PROXY_POLICY);
+LCRYPTO_USED(PROXY_CERT_INFO_EXTENSION_new);
+LCRYPTO_USED(PROXY_CERT_INFO_EXTENSION_free);
+LCRYPTO_USED(d2i_PROXY_CERT_INFO_EXTENSION);
+LCRYPTO_USED(i2d_PROXY_CERT_INFO_EXTENSION);
+LCRYPTO_USED(BASIC_CONSTRAINTS_new);
+LCRYPTO_USED(BASIC_CONSTRAINTS_free);
+LCRYPTO_USED(d2i_BASIC_CONSTRAINTS);
+LCRYPTO_USED(i2d_BASIC_CONSTRAINTS);
+LCRYPTO_USED(SXNET_new);
+LCRYPTO_USED(SXNET_free);
+LCRYPTO_USED(d2i_SXNET);
+LCRYPTO_USED(i2d_SXNET);
+LCRYPTO_USED(SXNETID_new);
+LCRYPTO_USED(SXNETID_free);
+LCRYPTO_USED(d2i_SXNETID);
+LCRYPTO_USED(i2d_SXNETID);
+LCRYPTO_USED(SXNET_add_id_asc);
+LCRYPTO_USED(SXNET_add_id_ulong);
+LCRYPTO_USED(SXNET_add_id_INTEGER);
+LCRYPTO_USED(SXNET_get_id_asc);
+LCRYPTO_USED(SXNET_get_id_ulong);
+LCRYPTO_USED(SXNET_get_id_INTEGER);
+LCRYPTO_USED(AUTHORITY_KEYID_new);
+LCRYPTO_USED(AUTHORITY_KEYID_free);
+LCRYPTO_USED(d2i_AUTHORITY_KEYID);
+LCRYPTO_USED(i2d_AUTHORITY_KEYID);
+LCRYPTO_USED(PKEY_USAGE_PERIOD_new);
+LCRYPTO_USED(PKEY_USAGE_PERIOD_free);
+LCRYPTO_USED(d2i_PKEY_USAGE_PERIOD);
+LCRYPTO_USED(i2d_PKEY_USAGE_PERIOD);
+LCRYPTO_USED(GENERAL_NAME_new);
+LCRYPTO_USED(GENERAL_NAME_free);
+LCRYPTO_USED(d2i_GENERAL_NAME);
+LCRYPTO_USED(i2d_GENERAL_NAME);
+LCRYPTO_USED(GENERAL_NAME_dup);
+LCRYPTO_USED(GENERAL_NAME_cmp);
+LCRYPTO_USED(v2i_ASN1_BIT_STRING);
+LCRYPTO_USED(i2v_ASN1_BIT_STRING);
+LCRYPTO_USED(i2v_GENERAL_NAME);
+LCRYPTO_USED(GENERAL_NAME_print);
+LCRYPTO_USED(GENERAL_NAMES_new);
+LCRYPTO_USED(GENERAL_NAMES_free);
+LCRYPTO_USED(d2i_GENERAL_NAMES);
+LCRYPTO_USED(i2d_GENERAL_NAMES);
+LCRYPTO_USED(i2v_GENERAL_NAMES);
+LCRYPTO_USED(v2i_GENERAL_NAMES);
+LCRYPTO_USED(OTHERNAME_new);
+LCRYPTO_USED(OTHERNAME_free);
+LCRYPTO_USED(d2i_OTHERNAME);
+LCRYPTO_USED(i2d_OTHERNAME);
+LCRYPTO_USED(EDIPARTYNAME_new);
+LCRYPTO_USED(EDIPARTYNAME_free);
+LCRYPTO_USED(d2i_EDIPARTYNAME);
+LCRYPTO_USED(i2d_EDIPARTYNAME);
+LCRYPTO_USED(OTHERNAME_cmp);
+LCRYPTO_USED(GENERAL_NAME_set0_value);
+LCRYPTO_USED(GENERAL_NAME_get0_value);
+LCRYPTO_USED(GENERAL_NAME_set0_othername);
+LCRYPTO_USED(GENERAL_NAME_get0_otherName);
+LCRYPTO_USED(i2s_ASN1_OCTET_STRING);
+LCRYPTO_USED(s2i_ASN1_OCTET_STRING);
+LCRYPTO_USED(EXTENDED_KEY_USAGE_new);
+LCRYPTO_USED(EXTENDED_KEY_USAGE_free);
+LCRYPTO_USED(d2i_EXTENDED_KEY_USAGE);
+LCRYPTO_USED(i2d_EXTENDED_KEY_USAGE);
+LCRYPTO_USED(i2a_ACCESS_DESCRIPTION);
+LCRYPTO_USED(CERTIFICATEPOLICIES_new);
+LCRYPTO_USED(CERTIFICATEPOLICIES_free);
+LCRYPTO_USED(d2i_CERTIFICATEPOLICIES);
+LCRYPTO_USED(i2d_CERTIFICATEPOLICIES);
+LCRYPTO_USED(POLICYINFO_new);
+LCRYPTO_USED(POLICYINFO_free);
+LCRYPTO_USED(d2i_POLICYINFO);
+LCRYPTO_USED(i2d_POLICYINFO);
+LCRYPTO_USED(POLICYQUALINFO_new);
+LCRYPTO_USED(POLICYQUALINFO_free);
+LCRYPTO_USED(d2i_POLICYQUALINFO);
+LCRYPTO_USED(i2d_POLICYQUALINFO);
+LCRYPTO_USED(USERNOTICE_new);
+LCRYPTO_USED(USERNOTICE_free);
+LCRYPTO_USED(d2i_USERNOTICE);
+LCRYPTO_USED(i2d_USERNOTICE);
+LCRYPTO_USED(NOTICEREF_new);
+LCRYPTO_USED(NOTICEREF_free);
+LCRYPTO_USED(d2i_NOTICEREF);
+LCRYPTO_USED(i2d_NOTICEREF);
+LCRYPTO_USED(CRL_DIST_POINTS_new);
+LCRYPTO_USED(CRL_DIST_POINTS_free);
+LCRYPTO_USED(d2i_CRL_DIST_POINTS);
+LCRYPTO_USED(i2d_CRL_DIST_POINTS);
+LCRYPTO_USED(DIST_POINT_new);
+LCRYPTO_USED(DIST_POINT_free);
+LCRYPTO_USED(d2i_DIST_POINT);
+LCRYPTO_USED(i2d_DIST_POINT);
+LCRYPTO_USED(DIST_POINT_NAME_new);
+LCRYPTO_USED(DIST_POINT_NAME_free);
+LCRYPTO_USED(d2i_DIST_POINT_NAME);
+LCRYPTO_USED(i2d_DIST_POINT_NAME);
+LCRYPTO_USED(ISSUING_DIST_POINT_new);
+LCRYPTO_USED(ISSUING_DIST_POINT_free);
+LCRYPTO_USED(d2i_ISSUING_DIST_POINT);
+LCRYPTO_USED(i2d_ISSUING_DIST_POINT);
+LCRYPTO_USED(DIST_POINT_set_dpname);
+LCRYPTO_USED(NAME_CONSTRAINTS_check);
+LCRYPTO_USED(ACCESS_DESCRIPTION_new);
+LCRYPTO_USED(ACCESS_DESCRIPTION_free);
+LCRYPTO_USED(d2i_ACCESS_DESCRIPTION);
+LCRYPTO_USED(i2d_ACCESS_DESCRIPTION);
+LCRYPTO_USED(AUTHORITY_INFO_ACCESS_new);
+LCRYPTO_USED(AUTHORITY_INFO_ACCESS_free);
+LCRYPTO_USED(d2i_AUTHORITY_INFO_ACCESS);
+LCRYPTO_USED(i2d_AUTHORITY_INFO_ACCESS);
+LCRYPTO_USED(POLICY_MAPPING_new);
+LCRYPTO_USED(POLICY_MAPPING_free);
+LCRYPTO_USED(GENERAL_SUBTREE_new);
+LCRYPTO_USED(GENERAL_SUBTREE_free);
+LCRYPTO_USED(NAME_CONSTRAINTS_new);
+LCRYPTO_USED(NAME_CONSTRAINTS_free);
+LCRYPTO_USED(POLICY_CONSTRAINTS_new);
+LCRYPTO_USED(POLICY_CONSTRAINTS_free);
+LCRYPTO_USED(a2i_GENERAL_NAME);
+LCRYPTO_USED(v2i_GENERAL_NAME);
+LCRYPTO_USED(v2i_GENERAL_NAME_ex);
+LCRYPTO_USED(X509V3_conf_free);
+LCRYPTO_USED(X509V3_EXT_nconf_nid);
+LCRYPTO_USED(X509V3_EXT_nconf);
+LCRYPTO_USED(X509V3_EXT_add_nconf_sk);
+LCRYPTO_USED(X509V3_EXT_add_nconf);
+LCRYPTO_USED(X509V3_EXT_REQ_add_nconf);
+LCRYPTO_USED(X509V3_EXT_CRL_add_nconf);
+LCRYPTO_USED(X509V3_EXT_conf_nid);
+LCRYPTO_USED(X509V3_EXT_conf);
+LCRYPTO_USED(X509V3_EXT_add_conf);
+LCRYPTO_USED(X509V3_EXT_REQ_add_conf);
+LCRYPTO_USED(X509V3_EXT_CRL_add_conf);
+LCRYPTO_USED(X509V3_add_value_bool_nf);
+LCRYPTO_USED(X509V3_get_value_bool);
+LCRYPTO_USED(X509V3_get_value_int);
+LCRYPTO_USED(X509V3_set_nconf);
+LCRYPTO_USED(X509V3_set_conf_lhash);
+LCRYPTO_USED(X509V3_get_string);
+LCRYPTO_USED(X509V3_get_section);
+LCRYPTO_USED(X509V3_string_free);
+LCRYPTO_USED(X509V3_section_free);
+LCRYPTO_USED(X509V3_set_ctx);
+LCRYPTO_USED(X509V3_add_value);
+LCRYPTO_USED(X509V3_add_value_uchar);
+LCRYPTO_USED(X509V3_add_value_bool);
+LCRYPTO_USED(X509V3_add_value_int);
+LCRYPTO_USED(i2s_ASN1_INTEGER);
+LCRYPTO_USED(s2i_ASN1_INTEGER);
+LCRYPTO_USED(i2s_ASN1_ENUMERATED);
+LCRYPTO_USED(i2s_ASN1_ENUMERATED_TABLE);
+LCRYPTO_USED(X509V3_EXT_add);
+LCRYPTO_USED(X509V3_EXT_add_list);
+LCRYPTO_USED(X509V3_EXT_add_alias);
+LCRYPTO_USED(X509V3_EXT_cleanup);
+LCRYPTO_USED(X509V3_EXT_get);
+LCRYPTO_USED(X509V3_EXT_get_nid);
+LCRYPTO_USED(X509V3_add_standard_extensions);
+LCRYPTO_USED(X509V3_parse_list);
+LCRYPTO_USED(X509V3_EXT_d2i);
+LCRYPTO_USED(X509V3_get_d2i);
+LCRYPTO_USED(X509V3_EXT_i2d);
+LCRYPTO_USED(X509V3_add1_i2d);
+LCRYPTO_USED(hex_to_string);
+LCRYPTO_USED(string_to_hex);
+LCRYPTO_USED(X509V3_EXT_val_prn);
+LCRYPTO_USED(X509V3_EXT_print);
+LCRYPTO_USED(X509V3_EXT_print_fp);
+LCRYPTO_USED(X509V3_extensions_print);
+LCRYPTO_USED(X509_check_ca);
+LCRYPTO_USED(X509_check_purpose);
+LCRYPTO_USED(X509_supported_extension);
+LCRYPTO_USED(X509_PURPOSE_set);
+LCRYPTO_USED(X509_check_issued);
+LCRYPTO_USED(X509_check_akid);
+LCRYPTO_USED(X509_PURPOSE_get_count);
+LCRYPTO_USED(X509_PURPOSE_get0);
+LCRYPTO_USED(X509_PURPOSE_get_by_sname);
+LCRYPTO_USED(X509_PURPOSE_get_by_id);
+LCRYPTO_USED(X509_PURPOSE_add);
+LCRYPTO_USED(X509_PURPOSE_get0_name);
+LCRYPTO_USED(X509_PURPOSE_get0_sname);
+LCRYPTO_USED(X509_PURPOSE_get_trust);
+LCRYPTO_USED(X509_PURPOSE_cleanup);
+LCRYPTO_USED(X509_PURPOSE_get_id);
+LCRYPTO_USED(X509_get_extension_flags);
+LCRYPTO_USED(X509_get_key_usage);
+LCRYPTO_USED(X509_get_extended_key_usage);
+LCRYPTO_USED(X509_get1_email);
+LCRYPTO_USED(X509_REQ_get1_email);
+LCRYPTO_USED(X509_email_free);
+LCRYPTO_USED(X509_get1_ocsp);
+LCRYPTO_USED(X509_check_host);
+LCRYPTO_USED(X509_check_email);
+LCRYPTO_USED(X509_check_ip);
+LCRYPTO_USED(X509_check_ip_asc);
+LCRYPTO_USED(a2i_IPADDRESS);
+LCRYPTO_USED(a2i_IPADDRESS_NC);
+LCRYPTO_USED(a2i_ipadd);
+LCRYPTO_USED(X509V3_NAME_from_section);
+LCRYPTO_USED(X509_POLICY_NODE_print);
+LCRYPTO_USED(ASRange_new);
+LCRYPTO_USED(ASRange_free);
+LCRYPTO_USED(d2i_ASRange);
+LCRYPTO_USED(i2d_ASRange);
+LCRYPTO_USED(ASIdOrRange_new);
+LCRYPTO_USED(ASIdOrRange_free);
+LCRYPTO_USED(d2i_ASIdOrRange);
+LCRYPTO_USED(i2d_ASIdOrRange);
+LCRYPTO_USED(ASIdentifierChoice_new);
+LCRYPTO_USED(ASIdentifierChoice_free);
+LCRYPTO_USED(d2i_ASIdentifierChoice);
+LCRYPTO_USED(i2d_ASIdentifierChoice);
+LCRYPTO_USED(ASIdentifiers_new);
+LCRYPTO_USED(ASIdentifiers_free);
+LCRYPTO_USED(d2i_ASIdentifiers);
+LCRYPTO_USED(i2d_ASIdentifiers);
+LCRYPTO_USED(IPAddressRange_new);
+LCRYPTO_USED(IPAddressRange_free);
+LCRYPTO_USED(d2i_IPAddressRange);
+LCRYPTO_USED(i2d_IPAddressRange);
+LCRYPTO_USED(IPAddressOrRange_new);
+LCRYPTO_USED(IPAddressOrRange_free);
+LCRYPTO_USED(d2i_IPAddressOrRange);
+LCRYPTO_USED(i2d_IPAddressOrRange);
+LCRYPTO_USED(IPAddressChoice_new);
+LCRYPTO_USED(IPAddressChoice_free);
+LCRYPTO_USED(d2i_IPAddressChoice);
+LCRYPTO_USED(i2d_IPAddressChoice);
+LCRYPTO_USED(IPAddressFamily_new);
+LCRYPTO_USED(IPAddressFamily_free);
+LCRYPTO_USED(d2i_IPAddressFamily);
+LCRYPTO_USED(i2d_IPAddressFamily);
+LCRYPTO_USED(X509v3_asid_add_inherit);
+LCRYPTO_USED(X509v3_asid_add_id_or_range);
+LCRYPTO_USED(X509v3_addr_add_inherit);
+LCRYPTO_USED(X509v3_addr_add_prefix);
+LCRYPTO_USED(X509v3_addr_add_range);
+LCRYPTO_USED(X509v3_addr_get_afi);
+LCRYPTO_USED(X509v3_addr_get_range);
+LCRYPTO_USED(X509v3_asid_is_canonical);
+LCRYPTO_USED(X509v3_addr_is_canonical);
+LCRYPTO_USED(X509v3_asid_canonize);
+LCRYPTO_USED(X509v3_addr_canonize);
+LCRYPTO_USED(X509v3_asid_inherits);
+LCRYPTO_USED(X509v3_addr_inherits);
+LCRYPTO_USED(X509v3_asid_subset);
+LCRYPTO_USED(X509v3_addr_subset);
+LCRYPTO_USED(X509v3_asid_validate_path);
+LCRYPTO_USED(X509v3_addr_validate_path);
+LCRYPTO_USED(X509v3_asid_validate_resource_set);
+LCRYPTO_USED(X509v3_addr_validate_resource_set);
+LCRYPTO_USED(ERR_load_X509V3_strings);
+
+#endif /* _LIBCRYPTO_X509V3_H */