Hide symbols in dso and ct

ok jsing@

14 files changed, 313 insertions, 11 deletions

diff --git a/src/lib/libcrypto/Symbols.namespace b/src/lib/libcrypto/Symbols.namespace
index b62f9db02b..6c25ed87cf 100644
--- a/src/lib/libcrypto/Symbols.namespace
+++ b/src/lib/libcrypto/Symbols.namespace
@@ -1795,3 +1795,84 @@ _libre_lh_node_usage_stats_bio
 _libre_SM3_Init
 _libre_SM3_Update
 _libre_SM3_Final
+_libre_DSO_new
+_libre_DSO_new_method
+_libre_DSO_free
+_libre_DSO_flags
+_libre_DSO_up_ref
+_libre_DSO_ctrl
+_libre_DSO_set_name_converter
+_libre_DSO_get_filename
+_libre_DSO_set_filename
+_libre_DSO_convert_filename
+_libre_DSO_merge
+_libre_DSO_get_loaded_filename
+_libre_DSO_set_default_method
+_libre_DSO_get_default_method
+_libre_DSO_get_method
+_libre_DSO_set_method
+_libre_DSO_load
+_libre_DSO_bind_var
+_libre_DSO_bind_func
+_libre_DSO_METHOD_openssl
+_libre_DSO_METHOD_null
+_libre_DSO_METHOD_dlfcn
+_libre_DSO_pathbyaddr
+_libre_DSO_global_lookup
+_libre_ERR_load_DSO_strings
+_libre_CT_POLICY_EVAL_CTX_new
+_libre_CT_POLICY_EVAL_CTX_free
+_libre_CT_POLICY_EVAL_CTX_get0_cert
+_libre_CT_POLICY_EVAL_CTX_set1_cert
+_libre_CT_POLICY_EVAL_CTX_get0_issuer
+_libre_CT_POLICY_EVAL_CTX_set1_issuer
+_libre_CT_POLICY_EVAL_CTX_get0_log_store
+_libre_CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
+_libre_CT_POLICY_EVAL_CTX_get_time
+_libre_CT_POLICY_EVAL_CTX_set_time
+_libre_SCT_new
+_libre_SCT_new_from_base64
+_libre_SCT_free
+_libre_SCT_LIST_free
+_libre_SCT_get_version
+_libre_SCT_set_version
+_libre_SCT_get_log_entry_type
+_libre_SCT_set_log_entry_type
+_libre_SCT_get0_log_id
+_libre_SCT_set0_log_id
+_libre_SCT_set1_log_id
+_libre_SCT_get_timestamp
+_libre_SCT_set_timestamp
+_libre_SCT_get_signature_nid
+_libre_SCT_set_signature_nid
+_libre_SCT_get0_extensions
+_libre_SCT_set0_extensions
+_libre_SCT_set1_extensions
+_libre_SCT_get0_signature
+_libre_SCT_set0_signature
+_libre_SCT_set1_signature
+_libre_SCT_get_source
+_libre_SCT_set_source
+_libre_SCT_validation_status_string
+_libre_SCT_print
+_libre_SCT_LIST_print
+_libre_SCT_get_validation_status
+_libre_SCT_validate
+_libre_SCT_LIST_validate
+_libre_i2o_SCT_LIST
+_libre_o2i_SCT_LIST
+_libre_i2d_SCT_LIST
+_libre_d2i_SCT_LIST
+_libre_i2o_SCT
+_libre_o2i_SCT
+_libre_CTLOG_new
+_libre_CTLOG_new_from_base64
+_libre_CTLOG_free
+_libre_CTLOG_get0_name
+_libre_CTLOG_get0_log_id
+_libre_CTLOG_get0_public_key
+_libre_CTLOG_STORE_new
+_libre_CTLOG_STORE_free
+_libre_CTLOG_STORE_get0_log_by_id
+_libre_CTLOG_STORE_load_file
+_libre_CTLOG_STORE_load_default_file
diff --git a/src/lib/libcrypto/ct/ct_b64.c b/src/lib/libcrypto/ct/ct_b64.c
index bfc69a7da3..101cd1e2b1 100644
--- a/src/lib/libcrypto/ct/ct_b64.c
+++ b/src/lib/libcrypto/ct/ct_b64.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ct_b64.c,v 1.6 2021/12/20 17:19:19 jsing Exp $ */
+/*      $OpenBSD: ct_b64.c,v 1.7 2023/07/08 07:22:58 beck Exp $ */
 /*
  * Written by Rob Stradling (rob@comodo.com) and Stephen Henson
  * (steve@openssl.org) for the OpenSSL project 2014.
@@ -180,6 +180,7 @@ SCT_new_from_base64(unsigned char version, const char *logid_base64,
         SCT_free(sct);
         return NULL;
 }
+LCRYPTO_ALIAS(SCT_new_from_base64);
 
 /*
  * Allocate, build and returns a new |ct_log| from input |pkey_base64|
@@ -222,3 +223,4 @@ CTLOG_new_from_base64(CTLOG **ct_log, const char *pkey_base64, const char *name)
 
         return 1;
 }
+LCRYPTO_ALIAS(CTLOG_new_from_base64);
diff --git a/src/lib/libcrypto/ct/ct_log.c b/src/lib/libcrypto/ct/ct_log.c
index f6e3aa25d5..eb503a3816 100644
--- a/src/lib/libcrypto/ct/ct_log.c
+++ b/src/lib/libcrypto/ct/ct_log.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ct_log.c,v 1.5 2021/12/18 16:34:52 tb Exp $ */
+/*      $OpenBSD: ct_log.c,v 1.6 2023/07/08 07:22:58 beck Exp $ */
 /* Author: Adam Eijdenberg <adam.eijdenberg@gmail.com>. */
 /* ====================================================================
  * Copyright (c) 1998-2016 The OpenSSL Project.  All rights reserved.
@@ -162,6 +162,7 @@ CTLOG_STORE_new(void)
         free(ret);
         return NULL;
 }
+LCRYPTO_ALIAS(CTLOG_STORE_new);
 
 void
 CTLOG_STORE_free(CTLOG_STORE *store)
@@ -171,6 +172,7 @@ CTLOG_STORE_free(CTLOG_STORE *store)
                 free(store);
         }
 }
+LCRYPTO_ALIAS(CTLOG_STORE_free);
 
 static int
 ctlog_new_from_conf(CTLOG **ct_log, const CONF *conf, const char *section)
@@ -198,6 +200,7 @@ CTLOG_STORE_load_default_file(CTLOG_STORE *store)
 {
         return CTLOG_STORE_load_file(store, CTLOG_FILE);
 }
+LCRYPTO_ALIAS(CTLOG_STORE_load_default_file);
 
 /*
  * Called by CONF_parse_list, which stops if this returns <= 0,
@@ -283,6 +286,7 @@ CTLOG_STORE_load_file(CTLOG_STORE *store, const char *file)
         ctlog_store_load_ctx_free(load_ctx);
         return ret;
 }
+LCRYPTO_ALIAS(CTLOG_STORE_load_file);
 
 /*
  * Initialize a new CTLOG object.
@@ -314,6 +318,7 @@ CTLOG_new(EVP_PKEY *public_key, const char *name)
         CTLOG_free(ret);
         return NULL;
 }
+LCRYPTO_ALIAS(CTLOG_new);
 
 /* Frees CT log and associated structures */
 void
@@ -325,12 +330,14 @@ CTLOG_free(CTLOG *log)
                 free(log);
         }
 }
+LCRYPTO_ALIAS(CTLOG_free);
 
 const char *
 CTLOG_get0_name(const CTLOG *log)
 {
         return log->name;
 }
+LCRYPTO_ALIAS(CTLOG_get0_name);
 
 void
 CTLOG_get0_log_id(const CTLOG *log, const uint8_t **log_id, size_t *log_id_len)
@@ -338,12 +345,14 @@ CTLOG_get0_log_id(const CTLOG *log, const uint8_t **log_id, size_t *log_id_len)
         *log_id = log->log_id;
         *log_id_len = CT_V1_HASHLEN;
 }
+LCRYPTO_ALIAS(CTLOG_get0_log_id);
 
 EVP_PKEY *
 CTLOG_get0_public_key(const CTLOG *log)
 {
         return log->public_key;
 }
+LCRYPTO_ALIAS(CTLOG_get0_public_key);
 
 /*
  * Given a log ID, finds the matching log.
@@ -363,3 +372,4 @@ CTLOG_STORE_get0_log_by_id(const CTLOG_STORE *store, const uint8_t *log_id,
 
         return NULL;
 }
+LCRYPTO_ALIAS(CTLOG_STORE_get0_log_by_id);
diff --git a/src/lib/libcrypto/ct/ct_oct.c b/src/lib/libcrypto/ct/ct_oct.c
index 94e67c6bc3..1f5e5c75d0 100644
--- a/src/lib/libcrypto/ct/ct_oct.c
+++ b/src/lib/libcrypto/ct/ct_oct.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ct_oct.c,v 1.8 2021/12/20 17:23:07 jsing Exp $ */
+/*      $OpenBSD: ct_oct.c,v 1.9 2023/07/08 07:22:58 beck Exp $ */
 /*
  * Written by Rob Stradling (rob@comodo.com) and Stephen Henson
  * (steve@openssl.org) for the OpenSSL project 2014.
@@ -208,6 +208,7 @@ o2i_SCT(SCT **psct, const unsigned char **in, size_t len)
 
         return sct;
 }
+LCRYPTO_ALIAS(o2i_SCT);
 
 int
 i2o_SCT_signature(const SCT *sct, unsigned char **out)
@@ -314,6 +315,7 @@ i2o_SCT(const SCT *sct, unsigned char **out)
         free(pstart);
         return -1;
 }
+LCRYPTO_ALIAS(i2o_SCT);
 
 STACK_OF(SCT) *
 o2i_SCT_LIST(STACK_OF(SCT) **out_scts, const unsigned char **pp, size_t len)
@@ -366,6 +368,7 @@ o2i_SCT_LIST(STACK_OF(SCT) **out_scts, const unsigned char **pp, size_t len)
 
         return NULL;
 }
+LCRYPTO_ALIAS(o2i_SCT_LIST);
 
 int
 i2o_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **pp)
@@ -422,6 +425,7 @@ i2o_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **pp)
         }
         return -1;
 }
+LCRYPTO_ALIAS(i2o_SCT_LIST);
 
 STACK_OF(SCT) *
 d2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp, long len)
@@ -441,6 +445,7 @@ d2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp, long len)
         ASN1_OCTET_STRING_free(oct);
         return sk;
 }
+LCRYPTO_ALIAS(d2i_SCT_LIST);
 
 int
 i2d_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **out)
@@ -456,3 +461,4 @@ i2d_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **out)
         free(oct.data);
         return len;
 }
+LCRYPTO_ALIAS(i2d_SCT_LIST);
diff --git a/src/lib/libcrypto/ct/ct_policy.c b/src/lib/libcrypto/ct/ct_policy.c
index 2cb3e69333..eb2b312019 100644
--- a/src/lib/libcrypto/ct/ct_policy.c
+++ b/src/lib/libcrypto/ct/ct_policy.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ct_policy.c,v 1.5 2021/12/18 16:34:52 tb Exp $ */
+/*      $OpenBSD: ct_policy.c,v 1.6 2023/07/08 07:22:58 beck Exp $ */
 /*
  * Implementations of Certificate Transparency SCT policies.
  * Written by Rob Percival (robpercival@google.com) for the OpenSSL project.
@@ -86,6 +86,7 @@ CT_POLICY_EVAL_CTX_new(void)
 
         return ctx;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_new);
 
 void
 CT_POLICY_EVAL_CTX_free(CT_POLICY_EVAL_CTX *ctx)
@@ -96,6 +97,7 @@ CT_POLICY_EVAL_CTX_free(CT_POLICY_EVAL_CTX *ctx)
         X509_free(ctx->issuer);
         free(ctx);
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_free);
 
 int
 CT_POLICY_EVAL_CTX_set1_cert(CT_POLICY_EVAL_CTX *ctx, X509 *cert)
@@ -105,6 +107,7 @@ CT_POLICY_EVAL_CTX_set1_cert(CT_POLICY_EVAL_CTX *ctx, X509 *cert)
         ctx->cert = cert;
         return 1;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_set1_cert);
 
 int
 CT_POLICY_EVAL_CTX_set1_issuer(CT_POLICY_EVAL_CTX *ctx, X509 *issuer)
@@ -114,6 +117,7 @@ CT_POLICY_EVAL_CTX_set1_issuer(CT_POLICY_EVAL_CTX *ctx, X509 *issuer)
         ctx->issuer = issuer;
         return 1;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_set1_issuer);
 
 void
 CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(CT_POLICY_EVAL_CTX *ctx,
@@ -121,33 +125,39 @@ CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(CT_POLICY_EVAL_CTX *ctx,
 {
         ctx->log_store = log_store;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE);
 
 void
 CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX *ctx, uint64_t time_in_ms)
 {
         ctx->epoch_time_in_ms = time_in_ms;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_set_time);
 
 X509 *
 CT_POLICY_EVAL_CTX_get0_cert(const CT_POLICY_EVAL_CTX *ctx)
 {
         return ctx->cert;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_get0_cert);
 
 X509 *
 CT_POLICY_EVAL_CTX_get0_issuer(const CT_POLICY_EVAL_CTX *ctx)
 {
         return ctx->issuer;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_get0_issuer);
 
 const CTLOG_STORE *
 CT_POLICY_EVAL_CTX_get0_log_store(const CT_POLICY_EVAL_CTX *ctx)
 {
         return ctx->log_store;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_get0_log_store);
 
 uint64_t
 CT_POLICY_EVAL_CTX_get_time(const CT_POLICY_EVAL_CTX *ctx)
 {
         return ctx->epoch_time_in_ms;
 }
+LCRYPTO_ALIAS(CT_POLICY_EVAL_CTX_get_time);
diff --git a/src/lib/libcrypto/ct/ct_prn.c b/src/lib/libcrypto/ct/ct_prn.c
index ea4f3b2474..e6931eeb09 100644
--- a/src/lib/libcrypto/ct/ct_prn.c
+++ b/src/lib/libcrypto/ct/ct_prn.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ct_prn.c,v 1.6 2021/12/18 16:34:52 tb Exp $ */
+/*      $OpenBSD: ct_prn.c,v 1.7 2023/07/08 07:22:58 beck Exp $ */
 /*
  * Written by Rob Stradling (rob@comodo.com) and Stephen Henson
  * (steve@openssl.org) for the OpenSSL project 2014.
@@ -146,6 +146,7 @@ SCT_validation_status_string(const SCT *sct)
         }
         return "unknown status";
 }
+LCRYPTO_ALIAS(SCT_validation_status_string);
 
 void
 SCT_print(const SCT *sct, BIO *out, int indent, const CTLOG_STORE *log_store)
@@ -190,6 +191,7 @@ SCT_print(const SCT *sct, BIO *out, int indent, const CTLOG_STORE *log_store)
         BIO_printf(out, "\n%*s            ", indent + 4, "");
         BIO_hex_string(out, indent + 16, 16, sct->sig, sct->sig_len);
 }
+LCRYPTO_ALIAS(SCT_print);
 
 void
 SCT_LIST_print(const STACK_OF(SCT) *sct_list, BIO *out, int indent,
@@ -206,3 +208,4 @@ SCT_LIST_print(const STACK_OF(SCT) *sct_list, BIO *out, int indent,
                         BIO_printf(out, "%s", separator);
         }
 }
+LCRYPTO_ALIAS(SCT_LIST_print);
diff --git a/src/lib/libcrypto/ct/ct_sct.c b/src/lib/libcrypto/ct/ct_sct.c
index a05b0f92a2..16ee8d5576 100644
--- a/src/lib/libcrypto/ct/ct_sct.c
+++ b/src/lib/libcrypto/ct/ct_sct.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ct_sct.c,v 1.8 2022/01/22 00:29:59 inoguchi Exp $ */
+/*      $OpenBSD: ct_sct.c,v 1.9 2023/07/08 07:22:58 beck Exp $ */
 /*
  * Written by Rob Stradling (rob@comodo.com), Stephen Henson (steve@openssl.org)
  * and Adam Eijdenberg (adam.eijdenberg@gmail.com) for the OpenSSL project 2016.
@@ -85,6 +85,7 @@ SCT_new(void)
         sct->version = SCT_VERSION_NOT_SET;
         return sct;
 }
+LCRYPTO_ALIAS(SCT_new);
 
 void
 SCT_free(SCT *sct)
@@ -98,12 +99,14 @@ SCT_free(SCT *sct)
         free(sct->sct);
         free(sct);
 }
+LCRYPTO_ALIAS(SCT_free);
 
 void
 SCT_LIST_free(STACK_OF(SCT) *scts)
 {
         sk_SCT_pop_free(scts, SCT_free);
 }
+LCRYPTO_ALIAS(SCT_LIST_free);
 
 int
 SCT_set_version(SCT *sct, sct_version_t version)
@@ -116,6 +119,7 @@ SCT_set_version(SCT *sct, sct_version_t version)
         sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
         return 1;
 }
+LCRYPTO_ALIAS(SCT_set_version);
 
 int
 SCT_set_log_entry_type(SCT *sct, ct_log_entry_type_t entry_type)
@@ -133,6 +137,7 @@ SCT_set_log_entry_type(SCT *sct, ct_log_entry_type_t entry_type)
         CTerror(CT_R_UNSUPPORTED_ENTRY_TYPE);
         return 0;
 }
+LCRYPTO_ALIAS(SCT_set_log_entry_type);
 
 int
 SCT_set0_log_id(SCT *sct, unsigned char *log_id, size_t log_id_len)
@@ -148,6 +153,7 @@ SCT_set0_log_id(SCT *sct, unsigned char *log_id, size_t log_id_len)
         sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
         return 1;
 }
+LCRYPTO_ALIAS(SCT_set0_log_id);
 
 int
 SCT_set1_log_id(SCT *sct, const unsigned char *log_id, size_t log_id_len)
@@ -173,6 +179,7 @@ SCT_set1_log_id(SCT *sct, const unsigned char *log_id, size_t log_id_len)
         }
         return 1;
 }
+LCRYPTO_ALIAS(SCT_set1_log_id);
 
 
 void
@@ -181,6 +188,7 @@ SCT_set_timestamp(SCT *sct, uint64_t timestamp)
         sct->timestamp = timestamp;
         sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
 }
+LCRYPTO_ALIAS(SCT_set_timestamp);
 
 int
 SCT_set_signature_nid(SCT *sct, int nid)
@@ -201,6 +209,7 @@ SCT_set_signature_nid(SCT *sct, int nid)
                 return 0;
         }
 }
+LCRYPTO_ALIAS(SCT_set_signature_nid);
 
 void
 SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len)
@@ -210,6 +219,7 @@ SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len)
         sct->ext_len = ext_len;
         sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
 }
+LCRYPTO_ALIAS(SCT_set0_extensions);
 
 int
 SCT_set1_extensions(SCT *sct, const unsigned char *ext, size_t ext_len)
@@ -230,6 +240,7 @@ SCT_set1_extensions(SCT *sct, const unsigned char *ext, size_t ext_len)
         }
         return 1;
 }
+LCRYPTO_ALIAS(SCT_set1_extensions);
 
 void
 SCT_set0_signature(SCT *sct, unsigned char *sig, size_t sig_len)
@@ -239,6 +250,7 @@ SCT_set0_signature(SCT *sct, unsigned char *sig, size_t sig_len)
         sct->sig_len = sig_len;
         sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
 }
+LCRYPTO_ALIAS(SCT_set0_signature);
 
 int
 SCT_set1_signature(SCT *sct, const unsigned char *sig, size_t sig_len)
@@ -259,18 +271,21 @@ SCT_set1_signature(SCT *sct, const unsigned char *sig, size_t sig_len)
         }
         return 1;
 }
+LCRYPTO_ALIAS(SCT_set1_signature);
 
 sct_version_t
 SCT_get_version(const SCT *sct)
 {
         return sct->version;
 }
+LCRYPTO_ALIAS(SCT_get_version);
 
 ct_log_entry_type_t
 SCT_get_log_entry_type(const SCT *sct)
 {
         return sct->entry_type;
 }
+LCRYPTO_ALIAS(SCT_get_log_entry_type);
 
 size_t
 SCT_get0_log_id(const SCT *sct, unsigned char **log_id)
@@ -278,12 +293,14 @@ SCT_get0_log_id(const SCT *sct, unsigned char **log_id)
         *log_id = sct->log_id;
         return sct->log_id_len;
 }
+LCRYPTO_ALIAS(SCT_get0_log_id);
 
 uint64_t
 SCT_get_timestamp(const SCT *sct)
 {
         return sct->timestamp;
 }
+LCRYPTO_ALIAS(SCT_get_timestamp);
 
 int
 SCT_get_signature_nid(const SCT *sct)
@@ -303,6 +320,7 @@ SCT_get_signature_nid(const SCT *sct)
         }
         return NID_undef;
 }
+LCRYPTO_ALIAS(SCT_get_signature_nid);
 
 size_t
 SCT_get0_extensions(const SCT *sct, unsigned char **ext)
@@ -310,6 +328,7 @@ SCT_get0_extensions(const SCT *sct, unsigned char **ext)
         *ext = sct->ext;
         return sct->ext_len;
 }
+LCRYPTO_ALIAS(SCT_get0_extensions);
 
 size_t
 SCT_get0_signature(const SCT *sct, unsigned char **sig)
@@ -317,6 +336,7 @@ SCT_get0_signature(const SCT *sct, unsigned char **sig)
         *sig = sct->sig;
         return sct->sig_len;
 }
+LCRYPTO_ALIAS(SCT_get0_signature);
 
 int
 SCT_is_complete(const SCT *sct)
@@ -343,6 +363,7 @@ SCT_get_source(const SCT *sct)
 {
         return sct->source;
 }
+LCRYPTO_ALIAS(SCT_get_source);
 
 int
 SCT_set_source(SCT *sct, sct_source_t source)
@@ -361,12 +382,14 @@ SCT_set_source(SCT *sct, sct_source_t source)
         /* if we aren't sure, leave the log entry type alone */
         return 1;
 }
+LCRYPTO_ALIAS(SCT_set_source);
 
 sct_validation_status_t
 SCT_get_validation_status(const SCT *sct)
 {
         return sct->validation_status;
 }
+LCRYPTO_ALIAS(SCT_get_validation_status);
 
 int
 SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx)
@@ -455,6 +478,7 @@ SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx)
 
         return is_sct_valid;
 }
+LCRYPTO_ALIAS(SCT_validate);
 
 int
 SCT_LIST_validate(const STACK_OF(SCT) *scts, CT_POLICY_EVAL_CTX *ctx)
@@ -478,3 +502,4 @@ SCT_LIST_validate(const STACK_OF(SCT) *scts, CT_POLICY_EVAL_CTX *ctx)
 
         return are_scts_valid;
 }
+LCRYPTO_ALIAS(SCT_LIST_validate);
diff --git a/src/lib/libcrypto/dso/dso_dlfcn.c b/src/lib/libcrypto/dso/dso_dlfcn.c
index 95afd26b82..77c19aa27e 100644
--- a/src/lib/libcrypto/dso/dso_dlfcn.c
+++ b/src/lib/libcrypto/dso/dso_dlfcn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso_dlfcn.c,v 1.29 2017/01/29 17:49:23 beck Exp $ */
+/* $OpenBSD: dso_dlfcn.c,v 1.30 2023/07/08 07:22:58 beck Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -68,6 +68,7 @@ DSO_METHOD_dlfcn(void)
 {
         return NULL;
 }
+LCRYPTO_ALIAS(DSO_METHOD_dlfcn);
 #else
 
 #ifdef HAVE_DLFCN_H
@@ -105,6 +106,7 @@ DSO_METHOD_dlfcn(void)
 {
         return (&dso_meth_dlfcn);
 }
+LCRYPTO_ALIAS(DSO_METHOD_dlfcn);
 
 /* For this DSO_METHOD, our meth_data STACK will contain;
  * (i) the handle (void*) returned from dlopen().
diff --git a/src/lib/libcrypto/dso/dso_err.c b/src/lib/libcrypto/dso/dso_err.c
index 2eee155b57..9dec8a66b7 100644
--- a/src/lib/libcrypto/dso/dso_err.c
+++ b/src/lib/libcrypto/dso/dso_err.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso_err.c,v 1.10 2022/07/12 14:42:49 kn Exp $ */
+/* $OpenBSD: dso_err.c,v 1.11 2023/07/08 07:22:58 beck Exp $ */
 /* ====================================================================
  * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
  *
@@ -103,3 +103,4 @@ ERR_load_DSO_strings(void)
         }
 #endif
 }
+LCRYPTO_ALIAS(ERR_load_DSO_strings);
diff --git a/src/lib/libcrypto/dso/dso_lib.c b/src/lib/libcrypto/dso/dso_lib.c
index 6dc98803ec..ca762f68dc 100644
--- a/src/lib/libcrypto/dso/dso_lib.c
+++ b/src/lib/libcrypto/dso/dso_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso_lib.c,v 1.20 2018/08/24 19:27:01 tb Exp $ */
+/* $OpenBSD: dso_lib.c,v 1.21 2023/07/08 07:22:58 beck Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -70,24 +70,28 @@ DSO_new(void)
 {
         return (DSO_new_method(NULL));
 }
+LCRYPTO_ALIAS(DSO_new);
 
 void
 DSO_set_default_method(DSO_METHOD *meth)
 {
         default_DSO_meth = meth;
 }
+LCRYPTO_ALIAS(DSO_set_default_method);
 
 DSO_METHOD *
 DSO_get_default_method(void)
 {
         return (default_DSO_meth);
 }
+LCRYPTO_ALIAS(DSO_get_default_method);
 
 DSO_METHOD *
 DSO_get_method(DSO *dso)
 {
         return (dso->meth);
 }
+LCRYPTO_ALIAS(DSO_get_method);
 
 DSO_METHOD *
 DSO_set_method(DSO *dso, DSO_METHOD *meth)
@@ -98,6 +102,7 @@ DSO_set_method(DSO *dso, DSO_METHOD *meth)
         dso->meth = meth;
         return (mtmp);
 }
+LCRYPTO_ALIAS(DSO_set_method);
 
 DSO *
 DSO_new_method(DSO_METHOD *meth)
@@ -132,6 +137,7 @@ DSO_new_method(DSO_METHOD *meth)
         }
         return (ret);
 }
+LCRYPTO_ALIAS(DSO_new_method);
 
 int
 DSO_free(DSO *dso)
@@ -163,12 +169,14 @@ DSO_free(DSO *dso)
         free(dso);
         return (1);
 }
+LCRYPTO_ALIAS(DSO_free);
 
 int
 DSO_flags(DSO *dso)
 {
         return ((dso == NULL) ? 0 : dso->flags);
 }
+LCRYPTO_ALIAS(DSO_flags);
 
 
 int
@@ -184,6 +192,7 @@ DSO_up_ref(DSO *dso)
         refs = CRYPTO_add(&dso->references, 1, CRYPTO_LOCK_DSO);
         return ((refs > 1) ? 1 : 0);
 }
+LCRYPTO_ALIAS(DSO_up_ref);
 
 DSO *
 DSO_load(DSO *dso, const char *filename, DSO_METHOD *meth, int flags)
@@ -238,6 +247,7 @@ err:
                 DSO_free(ret);
         return (NULL);
 }
+LCRYPTO_ALIAS(DSO_load);
 
 void *
 DSO_bind_var(DSO *dso, const char *symname)
@@ -259,6 +269,7 @@ DSO_bind_var(DSO *dso, const char *symname)
         /* Success */
         return (ret);
 }
+LCRYPTO_ALIAS(DSO_bind_var);
 
 DSO_FUNC_TYPE
 DSO_bind_func(DSO *dso, const char *symname)
@@ -280,6 +291,7 @@ DSO_bind_func(DSO *dso, const char *symname)
         /* Success */
         return (ret);
 }
+LCRYPTO_ALIAS(DSO_bind_func);
 
 /* I don't really like these *_ctrl functions very much to be perfectly
  * honest. For one thing, I think I have to return a negative value for
@@ -317,6 +329,7 @@ DSO_ctrl(DSO *dso, int cmd, long larg, void *parg)
         }
         return (dso->meth->dso_ctrl(dso, cmd, larg, parg));
 }
+LCRYPTO_ALIAS(DSO_ctrl);
 
 int
 DSO_set_name_converter(DSO *dso, DSO_NAME_CONVERTER_FUNC cb,
@@ -331,6 +344,7 @@ DSO_set_name_converter(DSO *dso, DSO_NAME_CONVERTER_FUNC cb,
         dso->name_converter = cb;
         return (1);
 }
+LCRYPTO_ALIAS(DSO_set_name_converter);
 
 const char *
 DSO_get_filename(DSO *dso)
@@ -341,6 +355,7 @@ DSO_get_filename(DSO *dso)
         }
         return (dso->filename);
 }
+LCRYPTO_ALIAS(DSO_get_filename);
 
 int
 DSO_set_filename(DSO *dso, const char *filename)
@@ -365,6 +380,7 @@ DSO_set_filename(DSO *dso, const char *filename)
         dso->filename = copied;
         return (1);
 }
+LCRYPTO_ALIAS(DSO_set_filename);
 
 char *
 DSO_merge(DSO *dso, const char *filespec1, const char *filespec2)
@@ -384,6 +400,7 @@ DSO_merge(DSO *dso, const char *filespec1, const char *filespec2)
         }
         return (result);
 }
+LCRYPTO_ALIAS(DSO_merge);
 
 char *
 DSO_convert_filename(DSO *dso, const char *filename)
@@ -415,6 +432,7 @@ DSO_convert_filename(DSO *dso, const char *filename)
         }
         return (result);
 }
+LCRYPTO_ALIAS(DSO_convert_filename);
 
 const char *
 DSO_get_loaded_filename(DSO *dso)
@@ -425,6 +443,7 @@ DSO_get_loaded_filename(DSO *dso)
         }
         return (dso->loaded_filename);
 }
+LCRYPTO_ALIAS(DSO_get_loaded_filename);
 
 int
 DSO_pathbyaddr(void *addr, char *path, int sz)
@@ -438,6 +457,7 @@ DSO_pathbyaddr(void *addr, char *path, int sz)
         }
         return (*meth->pathbyaddr)(addr, path, sz);
 }
+LCRYPTO_ALIAS(DSO_pathbyaddr);
 
 void *
 DSO_global_lookup(const char *name)
@@ -451,3 +471,4 @@ DSO_global_lookup(const char *name)
         }
         return (*meth->globallookup)(name);
 }
+LCRYPTO_ALIAS(DSO_global_lookup);
diff --git a/src/lib/libcrypto/dso/dso_null.c b/src/lib/libcrypto/dso/dso_null.c
index a3dc0ec1ff..dfe6a84442 100644
--- a/src/lib/libcrypto/dso/dso_null.c
+++ b/src/lib/libcrypto/dso/dso_null.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso_null.c,v 1.7 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: dso_null.c,v 1.8 2023/07/08 07:22:58 beck Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -72,3 +72,4 @@ DSO_METHOD_null(void)
 {
         return (&dso_meth_null);
 }
+LCRYPTO_ALIAS(DSO_METHOD_null);
diff --git a/src/lib/libcrypto/dso/dso_openssl.c b/src/lib/libcrypto/dso/dso_openssl.c
index 37d8d5805f..a639a5c7dc 100644
--- a/src/lib/libcrypto/dso/dso_openssl.c
+++ b/src/lib/libcrypto/dso/dso_openssl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso_openssl.c,v 1.6 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: dso_openssl.c,v 1.7 2023/07/08 07:22:58 beck Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -73,3 +73,4 @@ DSO_METHOD_openssl(void)
         return (DSO_METHOD_null());
 #endif
 }
+LCRYPTO_ALIAS(DSO_METHOD_openssl);
diff --git a/src/lib/libcrypto/hidden/openssl/ct.h b/src/lib/libcrypto/hidden/openssl/ct.h
new file mode 100644
index 0000000000..a1c9b338ec
--- /dev/null
+++ b/src/lib/libcrypto/hidden/openssl/ct.h
@@ -0,0 +1,85 @@
+/* $OpenBSD: ct.h,v 1.1 2023/07/08 07:22:58 beck Exp $ */
+/*
+ * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_CT_H
+#define _LIBCRYPTO_CT_H
+
+#ifndef _MSC_VER
+#include_next <openssl/ct.h>
+#else
+#include "../include/openssl/ct.h"
+#endif
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_new);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_free);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_get0_cert);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_set1_cert);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_get0_issuer);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_set1_issuer);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_get0_log_store);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_get_time);
+LCRYPTO_USED(CT_POLICY_EVAL_CTX_set_time);
+LCRYPTO_USED(SCT_new);
+LCRYPTO_USED(SCT_new_from_base64);
+LCRYPTO_USED(SCT_free);
+LCRYPTO_USED(SCT_LIST_free);
+LCRYPTO_USED(SCT_get_version);
+LCRYPTO_USED(SCT_set_version);
+LCRYPTO_USED(SCT_get_log_entry_type);
+LCRYPTO_USED(SCT_set_log_entry_type);
+LCRYPTO_USED(SCT_get0_log_id);
+LCRYPTO_USED(SCT_set0_log_id);
+LCRYPTO_USED(SCT_set1_log_id);
+LCRYPTO_USED(SCT_get_timestamp);
+LCRYPTO_USED(SCT_set_timestamp);
+LCRYPTO_USED(SCT_get_signature_nid);
+LCRYPTO_USED(SCT_set_signature_nid);
+LCRYPTO_USED(SCT_get0_extensions);
+LCRYPTO_USED(SCT_set0_extensions);
+LCRYPTO_USED(SCT_set1_extensions);
+LCRYPTO_USED(SCT_get0_signature);
+LCRYPTO_USED(SCT_set0_signature);
+LCRYPTO_USED(SCT_set1_signature);
+LCRYPTO_USED(SCT_get_source);
+LCRYPTO_USED(SCT_set_source);
+LCRYPTO_USED(SCT_validation_status_string);
+LCRYPTO_USED(SCT_print);
+LCRYPTO_USED(SCT_LIST_print);
+LCRYPTO_USED(SCT_get_validation_status);
+LCRYPTO_USED(SCT_validate);
+LCRYPTO_USED(SCT_LIST_validate);
+LCRYPTO_USED(i2o_SCT_LIST);
+LCRYPTO_USED(o2i_SCT_LIST);
+LCRYPTO_USED(i2d_SCT_LIST);
+LCRYPTO_USED(d2i_SCT_LIST);
+LCRYPTO_USED(i2o_SCT);
+LCRYPTO_USED(o2i_SCT);
+LCRYPTO_USED(CTLOG_new);
+LCRYPTO_USED(CTLOG_new_from_base64);
+LCRYPTO_USED(CTLOG_free);
+LCRYPTO_USED(CTLOG_get0_name);
+LCRYPTO_USED(CTLOG_get0_log_id);
+LCRYPTO_USED(CTLOG_get0_public_key);
+LCRYPTO_USED(CTLOG_STORE_new);
+LCRYPTO_USED(CTLOG_STORE_free);
+LCRYPTO_USED(CTLOG_STORE_get0_log_by_id);
+LCRYPTO_USED(CTLOG_STORE_load_file);
+LCRYPTO_USED(CTLOG_STORE_load_default_file);
+
+#endif /* _LIBCRYPTO_CT_H */
diff --git a/src/lib/libcrypto/hidden/openssl/dso.h b/src/lib/libcrypto/hidden/openssl/dso.h
new file mode 100644
index 0000000000..a5e989c898
--- /dev/null
+++ b/src/lib/libcrypto/hidden/openssl/dso.h
@@ -0,0 +1,54 @@
+/* $OpenBSD: dso.h,v 1.1 2023/07/08 07:22:58 beck Exp $ */
+/*
+ * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_DSO_H
+#define _LIBCRYPTO_DSO_H
+
+#ifndef _MSC_VER
+#include_next <openssl/dso.h>
+#else
+#include "../include/openssl/dso.h"
+#endif
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(DSO_new);
+LCRYPTO_USED(DSO_new_method);
+LCRYPTO_USED(DSO_free);
+LCRYPTO_USED(DSO_flags);
+LCRYPTO_USED(DSO_up_ref);
+LCRYPTO_USED(DSO_ctrl);
+LCRYPTO_USED(DSO_set_name_converter);
+LCRYPTO_USED(DSO_get_filename);
+LCRYPTO_USED(DSO_set_filename);
+LCRYPTO_USED(DSO_convert_filename);
+LCRYPTO_USED(DSO_merge);
+LCRYPTO_USED(DSO_get_loaded_filename);
+LCRYPTO_USED(DSO_set_default_method);
+LCRYPTO_USED(DSO_get_default_method);
+LCRYPTO_USED(DSO_get_method);
+LCRYPTO_USED(DSO_set_method);
+LCRYPTO_USED(DSO_load);
+LCRYPTO_USED(DSO_bind_var);
+LCRYPTO_USED(DSO_bind_func);
+LCRYPTO_USED(DSO_METHOD_openssl);
+LCRYPTO_USED(DSO_METHOD_null);
+LCRYPTO_USED(DSO_METHOD_dlfcn);
+LCRYPTO_USED(DSO_pathbyaddr);
+LCRYPTO_USED(DSO_global_lookup);
+LCRYPTO_USED(ERR_load_DSO_strings);
+
+#endif /* _LIBCRYPTO_DSO_H */