Make file-local functions static

These functions are only used within their implementation files and do
not need external linkage. Mark them static.

ok tb

9 files changed, 27 insertions, 27 deletions

diff --git a/src/lib/libcrypto/aes/aes.c b/src/lib/libcrypto/aes/aes.c
index 027cb84064..db693d2dd8 100644
--- a/src/lib/libcrypto/aes/aes.c
+++ b/src/lib/libcrypto/aes/aes.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: aes.c,v 1.18 2026/07/31 00:50:52 kenjiro Exp $ */
+/* $OpenBSD: aes.c,v 1.19 2026/07/31 03:59:50 kenjiro Exp $ */
 /* ====================================================================
  * Copyright (c) 2002-2006 The OpenSSL Project.  All rights reserved.
  *
@@ -136,7 +136,7 @@ aes_encrypt_block128(const unsigned char *in, unsigned char *out, const void *ke
         aes_encrypt_internal(in, out, key);
 }
 
-void
+static void
 aes_decrypt_block128(const unsigned char *in, unsigned char *out, const void *key)
 {
         aes_decrypt_internal(in, out, key);
diff --git a/src/lib/libcrypto/pem/pem_info.c b/src/lib/libcrypto/pem/pem_info.c
index 26061f6f08..24f0ddb011 100644
--- a/src/lib/libcrypto/pem/pem_info.c
+++ b/src/lib/libcrypto/pem/pem_info.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pem_info.c,v 1.33 2025/07/16 15:59:26 tb Exp $ */
+/* $OpenBSD: pem_info.c,v 1.34 2026/07/31 03:59:50 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -77,7 +77,7 @@
 #include "err_local.h"
 #include "evp_local.h"
 
-X509_PKEY *
+static X509_PKEY *
 X509_PKEY_new(void)
 {
         X509_PKEY *x_pkey;
@@ -90,7 +90,7 @@ X509_PKEY_new(void)
         return x_pkey;
 }
 
-void
+static void
 X509_PKEY_free(X509_PKEY *x_pkey)
 {
         if (x_pkey == NULL)
diff --git a/src/lib/libcrypto/x509/x509_constraints.c b/src/lib/libcrypto/x509/x509_constraints.c
index 61a08cacef..be93f3fd6c 100644
--- a/src/lib/libcrypto/x509/x509_constraints.c
+++ b/src/lib/libcrypto/x509/x509_constraints.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_constraints.c,v 1.34 2026/07/14 15:52:52 jsing Exp $ */
+/* $OpenBSD: x509_constraints.c,v 1.35 2026/07/31 03:59:50 kenjiro Exp $ */
 /*
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
  *
@@ -76,7 +76,7 @@ host_is_ip_address(CBS *cbs, int *is_ip)
         return 1;
 }
 
-struct x509_constraints_name *
+static struct x509_constraints_name *
 x509_constraints_name_new(void)
 {
         return (calloc(1, sizeof(struct x509_constraints_name)));
@@ -100,7 +100,7 @@ x509_constraints_name_free(struct x509_constraints_name *name)
         free(name);
 }
 
-struct x509_constraints_name *
+static struct x509_constraints_name *
 x509_constraints_name_dup(struct x509_constraints_name *name)
 {
         struct x509_constraints_name *new;
@@ -724,7 +724,7 @@ x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint,
  * respectively for ipv4 addresses and constraints, and a length of
  * 16 and 32 respectively for ipv6 address constraints by the caller.
  */
-int
+static int
 x509_constraints_ipaddr(uint8_t *address, size_t alen, uint8_t *constraint,
     size_t len)
 {
@@ -746,7 +746,7 @@ x509_constraints_ipaddr(uint8_t *address, size_t alen, uint8_t *constraint,
  * Verify a canonicalized der encoded constraint dirname
  * a canonicalized der encoded constraint.
  */
-int
+static int
 x509_constraints_dirname(uint8_t *dirname, size_t dlen,
     uint8_t *constraint, size_t len)
 {
@@ -1194,7 +1194,7 @@ x509_constraints_extract_constraints(X509 *cert,
  * Match a validated name in "name" against a validated constraint in
  * "constraint" return 1 if then name matches, 0 otherwise.
  */
-int
+static int
 x509_constraints_match(struct x509_constraints_name *name,
     struct x509_constraints_name *constraint)
 {
diff --git a/src/lib/libcrypto/x509/x509_policy.c b/src/lib/libcrypto/x509/x509_policy.c
index 2df965aad1..addd4b29ef 100644
--- a/src/lib/libcrypto/x509/x509_policy.c
+++ b/src/lib/libcrypto/x509/x509_policy.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: x509_policy.c,v 1.33 2025/08/10 06:36:45 beck Exp $ */
+/*      $OpenBSD: x509_policy.c,v 1.34 2026/07/31 03:59:50 kenjiro Exp $ */
 /*
  * Copyright (c) 2022, Google Inc.
  *
@@ -158,7 +158,7 @@ DECLARE_STACK_OF(X509_POLICY_LEVEL)
  * this the OpenSSL way either, and we are not using this boringsslism
  * anywhere else. Callers should ensure that the stack in data is sorted.
  */
-void
+static void
 sk_X509_POLICY_NODE_delete_if(STACK_OF(X509_POLICY_NODE) *nodes,
     int (*delete_if)(X509_POLICY_NODE *, void *), void *data)
 {
diff --git a/src/lib/libcrypto/x509/x509_verify.c b/src/lib/libcrypto/x509/x509_verify.c
index af35cb0007..e0efa9ffc5 100644
--- a/src/lib/libcrypto/x509/x509_verify.c
+++ b/src/lib/libcrypto/x509/x509_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_verify.c,v 1.77 2026/06/10 04:26:58 tb Exp $ */
+/* $OpenBSD: x509_verify.c,v 1.78 2026/07/31 03:59:50 kenjiro Exp $ */
 /*
  * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
  *
@@ -83,7 +83,7 @@ x509_verify_asn1_time_to_time_t(const ASN1_TIME *atime, int notAfter,
         return asn1_time_tm_to_time_t(&tm, out);
 }
 
-struct x509_verify_chain *
+static struct x509_verify_chain *
 x509_verify_chain_new(void)
 {
         struct x509_verify_chain *chain;
@@ -199,7 +199,7 @@ x509_verify_chain_last(struct x509_verify_chain *chain)
         return sk_X509_value(chain->certs, last);
 }
 
-X509 *
+static X509 *
 x509_verify_chain_leaf(struct x509_verify_chain *chain)
 {
         if (chain->certs == NULL)
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index df45df47fc..929de03a3d 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.260 2026/06/06 15:22:25 jsing Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.261 2026/07/31 03:59:50 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1379,7 +1379,7 @@ ssl3_clear(SSL *s)
         s->s3->hs.state = SSL_ST_BEFORE|((s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT);
 }
 
-long
+static long
 _SSL_get_shared_group(SSL *s, long n)
 {
         size_t count;
@@ -1412,7 +1412,7 @@ _SSL_get_shared_group(SSL *s, long n)
         return nid;
 }
 
-long
+static long
 _SSL_get_peer_tmp_key(SSL *s, EVP_PKEY **key)
 {
         EVP_PKEY *pkey = NULL;
diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 2755cbc92d..467784da2b 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.163 2026/06/14 15:47:49 jsing Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.164 2026/07/31 03:59:50 kenjiro Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -2567,7 +2567,7 @@ tlsext_build(SSL *s, int is_server, uint16_t msg_type, CBB *cbb)
         return 1;
 }
 
-int
+static int
 tlsext_clienthello_hash_extension(SSL *s, uint16_t type, CBS *cbs)
 {
         /*
diff --git a/src/lib/libssl/tls13_record_layer.c b/src/lib/libssl/tls13_record_layer.c
index f5604adbeb..778356af15 100644
--- a/src/lib/libssl/tls13_record_layer.c
+++ b/src/lib/libssl/tls13_record_layer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_record_layer.c,v 1.74 2024/09/09 03:32:29 tb Exp $ */
+/* $OpenBSD: tls13_record_layer.c,v 1.75 2026/07/31 03:59:50 kenjiro Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -31,13 +31,13 @@ struct tls13_record_protection {
         uint8_t seq_num[TLS13_RECORD_SEQ_NUM_LEN];
 };
 
-struct tls13_record_protection *
+static struct tls13_record_protection *
 tls13_record_protection_new(void)
 {
         return calloc(1, sizeof(struct tls13_record_protection));
 }
 
-void
+static void
 tls13_record_protection_clear(struct tls13_record_protection *rp)
 {
         EVP_AEAD_CTX_free(rp->aead_ctx);
@@ -48,7 +48,7 @@ tls13_record_protection_clear(struct tls13_record_protection *rp)
         memset(rp, 0, sizeof(*rp));
 }
 
-void
+static void
 tls13_record_protection_free(struct tls13_record_protection *rp)
 {
         if (rp == NULL)
diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c
index 604dab4cba..8ad11c6428 100644
--- a/src/lib/libssl/tls13_server.c
+++ b/src/lib/libssl/tls13_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_server.c,v 1.112 2025/12/04 21:03:42 beck Exp $ */
+/* $OpenBSD: tls13_server.c,v 1.113 2026/07/31 03:59:50 kenjiro Exp $ */
 /*
  * Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
@@ -96,7 +96,7 @@ tls13_client_hello_is_legacy(CBS *cbs)
         return (max_version < TLS1_3_VERSION);
 }
 
-int
+static int
 tls13_client_hello_required_extensions(struct tls13_ctx *ctx)
 {
         SSL *s = ctx->ssl;