From ead8f79948b3367be90090b3eb5721ccecd7efeb Mon Sep 17 00:00:00 2001
From: beck <beck@openbsd.org>
Date: Sat, 8 Jul 2023 08:26:26 +0000
Subject: [PATCH] Hide symbols in cms, comp, conf, and buffer

ok jsing@
---
 lib/libcrypto/Symbols.namespace         | 137 ++++++++++++++++++++++
 lib/libcrypto/buffer/buf_err.c          |   3 +-
 lib/libcrypto/buffer/buffer.c           |   6 +-
 lib/libcrypto/cms/cms_asn1.c            |   3 +-
 lib/libcrypto/cms/cms_att.c             |  22 +++-
 lib/libcrypto/cms/cms_enc.c             |   3 +-
 lib/libcrypto/cms/cms_env.c             |  17 ++-
 lib/libcrypto/cms/cms_err.c             |   3 +-
 lib/libcrypto/cms/cms_ess.c             |   6 +-
 lib/libcrypto/cms/cms_io.c              |  10 +-
 lib/libcrypto/cms/cms_kari.c            |  11 +-
 lib/libcrypto/cms/cms_lib.c             |  22 +++-
 lib/libcrypto/cms/cms_pwri.c            |   4 +-
 lib/libcrypto/cms/cms_sd.c              |  20 +++-
 lib/libcrypto/cms/cms_smime.c           |  20 +++-
 lib/libcrypto/comp/c_rle.c              |   3 +-
 lib/libcrypto/comp/c_zlib.c             |   4 +-
 lib/libcrypto/comp/comp_err.c           |   3 +-
 lib/libcrypto/comp/comp_lib.c           |   6 +-
 lib/libcrypto/conf/conf_api.c           |   9 +-
 lib/libcrypto/hidden/openssl/buffer.h   |  34 ++++++
 lib/libcrypto/hidden/openssl/cms.h      | 146 ++++++++++++++++++++++++
 lib/libcrypto/hidden/openssl/comp.h     |  37 ++++++
 lib/libcrypto/hidden/openssl/conf_api.h |  36 ++++++
 24 files changed, 546 insertions(+), 19 deletions(-)
 create mode 100644 lib/libcrypto/hidden/openssl/buffer.h
 create mode 100644 lib/libcrypto/hidden/openssl/cms.h
 create mode 100644 lib/libcrypto/hidden/openssl/comp.h
 create mode 100644 lib/libcrypto/hidden/openssl/conf_api.h

diff --git a/lib/libcrypto/Symbols.namespace b/lib/libcrypto/Symbols.namespace
index 6c25ed87cf8..617fc06b13a 100644
--- a/lib/libcrypto/Symbols.namespace
+++ b/lib/libcrypto/Symbols.namespace
@@ -1876,3 +1876,140 @@ _libre_CTLOG_STORE_free
 _libre_CTLOG_STORE_get0_log_by_id
 _libre_CTLOG_STORE_load_file
 _libre_CTLOG_STORE_load_default_file
+_libre__CONF_new_section
+_libre__CONF_get_section
+_libre__CONF_get_section_values
+_libre__CONF_add_string
+_libre__CONF_get_string
+_libre__CONF_new_data
+_libre__CONF_free_data
+_libre_COMP_CTX_new
+_libre_COMP_CTX_free
+_libre_COMP_compress_block
+_libre_COMP_expand_block
+_libre_COMP_rle
+_libre_COMP_zlib
+_libre_COMP_zlib_cleanup
+_libre_ERR_load_COMP_strings
+_libre_CMS_ContentInfo_new
+_libre_CMS_ContentInfo_free
+_libre_d2i_CMS_ContentInfo
+_libre_i2d_CMS_ContentInfo
+_libre_CMS_ReceiptRequest_new
+_libre_CMS_ReceiptRequest_free
+_libre_d2i_CMS_ReceiptRequest
+_libre_i2d_CMS_ReceiptRequest
+_libre_CMS_ContentInfo_print_ctx
+_libre_CMS_get0_type
+_libre_CMS_dataInit
+_libre_CMS_dataFinal
+_libre_CMS_is_detached
+_libre_CMS_set_detached
+_libre_CMS_stream
+_libre_d2i_CMS_bio
+_libre_i2d_CMS_bio
+_libre_BIO_new_CMS
+_libre_i2d_CMS_bio_stream
+_libre_PEM_write_bio_CMS_stream
+_libre_SMIME_read_CMS
+_libre_SMIME_write_CMS
+_libre_CMS_final
+_libre_CMS_sign
+_libre_CMS_sign_receipt
+_libre_CMS_data
+_libre_CMS_data_create
+_libre_CMS_digest_verify
+_libre_CMS_digest_create
+_libre_CMS_EncryptedData_decrypt
+_libre_CMS_EncryptedData_encrypt
+_libre_CMS_EncryptedData_set1_key
+_libre_CMS_verify
+_libre_CMS_verify_receipt
+_libre_CMS_get0_signers
+_libre_CMS_encrypt
+_libre_CMS_decrypt
+_libre_CMS_decrypt_set1_pkey
+_libre_CMS_decrypt_set1_key
+_libre_CMS_decrypt_set1_password
+_libre_CMS_get0_RecipientInfos
+_libre_CMS_RecipientInfo_type
+_libre_CMS_RecipientInfo_get0_pkey_ctx
+_libre_CMS_EnvelopedData_create
+_libre_CMS_add1_recipient_cert
+_libre_CMS_RecipientInfo_set0_pkey
+_libre_CMS_RecipientInfo_ktri_cert_cmp
+_libre_CMS_RecipientInfo_ktri_get0_algs
+_libre_CMS_RecipientInfo_ktri_get0_signer_id
+_libre_CMS_add0_recipient_key
+_libre_CMS_RecipientInfo_kekri_get0_id
+_libre_CMS_RecipientInfo_set0_key
+_libre_CMS_RecipientInfo_kekri_id_cmp
+_libre_CMS_RecipientInfo_set0_password
+_libre_CMS_add0_recipient_password
+_libre_CMS_RecipientInfo_decrypt
+_libre_CMS_RecipientInfo_encrypt
+_libre_CMS_uncompress
+_libre_CMS_compress
+_libre_CMS_set1_eContentType
+_libre_CMS_get0_eContentType
+_libre_CMS_add0_CertificateChoices
+_libre_CMS_add0_cert
+_libre_CMS_add1_cert
+_libre_CMS_get1_certs
+_libre_CMS_add0_RevocationInfoChoice
+_libre_CMS_add0_crl
+_libre_CMS_add1_crl
+_libre_CMS_get1_crls
+_libre_CMS_SignedData_init
+_libre_CMS_add1_signer
+_libre_CMS_SignerInfo_get0_pkey_ctx
+_libre_CMS_SignerInfo_get0_md_ctx
+_libre_CMS_get0_SignerInfos
+_libre_CMS_SignerInfo_set1_signer_cert
+_libre_CMS_SignerInfo_get0_signer_id
+_libre_CMS_SignerInfo_cert_cmp
+_libre_CMS_set1_signers_certs
+_libre_CMS_SignerInfo_get0_algs
+_libre_CMS_SignerInfo_get0_signature
+_libre_CMS_SignerInfo_sign
+_libre_CMS_SignerInfo_verify
+_libre_CMS_SignerInfo_verify_content
+_libre_CMS_add_smimecap
+_libre_CMS_add_simple_smimecap
+_libre_CMS_add_standard_smimecap
+_libre_CMS_signed_get_attr_count
+_libre_CMS_signed_get_attr_by_NID
+_libre_CMS_signed_get_attr_by_OBJ
+_libre_CMS_signed_get_attr
+_libre_CMS_signed_delete_attr
+_libre_CMS_signed_add1_attr
+_libre_CMS_signed_add1_attr_by_OBJ
+_libre_CMS_signed_add1_attr_by_NID
+_libre_CMS_signed_add1_attr_by_txt
+_libre_CMS_signed_get0_data_by_OBJ
+_libre_CMS_unsigned_get_attr_count
+_libre_CMS_unsigned_get_attr_by_NID
+_libre_CMS_unsigned_get_attr_by_OBJ
+_libre_CMS_unsigned_get_attr
+_libre_CMS_unsigned_delete_attr
+_libre_CMS_unsigned_add1_attr
+_libre_CMS_unsigned_add1_attr_by_OBJ
+_libre_CMS_unsigned_add1_attr_by_NID
+_libre_CMS_unsigned_add1_attr_by_txt
+_libre_CMS_unsigned_get0_data_by_OBJ
+_libre_CMS_RecipientInfo_kari_get0_alg
+_libre_CMS_RecipientInfo_kari_get0_reks
+_libre_CMS_RecipientInfo_kari_get0_orig_id
+_libre_CMS_RecipientInfo_kari_orig_id_cmp
+_libre_CMS_RecipientEncryptedKey_get0_id
+_libre_CMS_RecipientEncryptedKey_cert_cmp
+_libre_CMS_RecipientInfo_kari_set0_pkey
+_libre_CMS_RecipientInfo_kari_get0_ctx
+_libre_CMS_RecipientInfo_kari_decrypt
+_libre_CMS_SharedInfo_encode
+_libre_ERR_load_CMS_strings
+_libre_BUF_MEM_new
+_libre_BUF_MEM_free
+_libre_BUF_MEM_grow
+_libre_BUF_MEM_grow_clean
+_libre_ERR_load_BUF_strings
diff --git a/lib/libcrypto/buffer/buf_err.c b/lib/libcrypto/buffer/buf_err.c
index 4dc1dca790f..3b045cf589a 100644
--- a/lib/libcrypto/buffer/buf_err.c
+++ b/lib/libcrypto/buffer/buf_err.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: buf_err.c,v 1.12 2022/07/12 14:42:48 kn Exp $ */
+/* $OpenBSD: buf_err.c,v 1.13 2023/07/08 08:26:26 beck Exp $ */
 /* ====================================================================
  * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
  *
@@ -86,3 +86,4 @@ ERR_load_BUF_strings(void)
 	}
 #endif
 }
+LCRYPTO_ALIAS(ERR_load_BUF_strings);
diff --git a/lib/libcrypto/buffer/buffer.c b/lib/libcrypto/buffer/buffer.c
index f4e84c44780..51ce90ff807 100644
--- a/lib/libcrypto/buffer/buffer.c
+++ b/lib/libcrypto/buffer/buffer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: buffer.c,v 1.27 2017/05/02 03:59:44 deraadt Exp $ */
+/* $OpenBSD: buffer.c,v 1.28 2023/07/08 08:26:26 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -82,6 +82,7 @@ BUF_MEM_new(void)
 
 	return (ret);
 }
+LCRYPTO_ALIAS(BUF_MEM_new);
 
 void
 BUF_MEM_free(BUF_MEM *a)
@@ -92,12 +93,14 @@ BUF_MEM_free(BUF_MEM *a)
 	freezero(a->data, a->max);
 	free(a);
 }
+LCRYPTO_ALIAS(BUF_MEM_free);
 
 int
 BUF_MEM_grow(BUF_MEM *str, size_t len)
 {
 	return BUF_MEM_grow_clean(str, len);
 }
+LCRYPTO_ALIAS(BUF_MEM_grow);
 
 int
 BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
@@ -128,6 +131,7 @@ BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
 
 	return (len);
 }
+LCRYPTO_ALIAS(BUF_MEM_grow_clean);
 
 void
 BUF_reverse(unsigned char *out, const unsigned char *in, size_t size)
diff --git a/lib/libcrypto/cms/cms_asn1.c b/lib/libcrypto/cms/cms_asn1.c
index 7948a3c39e3..531b8c587d5 100644
--- a/lib/libcrypto/cms/cms_asn1.c
+++ b/lib/libcrypto/cms/cms_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_asn1.c,v 1.22 2023/05/23 06:55:31 tb Exp $ */
+/* $OpenBSD: cms_asn1.c,v 1.23 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -1619,3 +1619,4 @@ CMS_SharedInfo_encode(unsigned char **pder, X509_ALGOR *kekalg,
 
 	return ASN1_item_i2d(intsi.a, pder, &CMS_SharedInfo_it);
 }
+LCRYPTO_ALIAS(CMS_SharedInfo_encode);
diff --git a/lib/libcrypto/cms/cms_att.c b/lib/libcrypto/cms/cms_att.c
index 0fb077f7d91..62362ad3f98 100644
--- a/lib/libcrypto/cms/cms_att.c
+++ b/lib/libcrypto/cms/cms_att.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_att.c,v 1.10 2022/11/26 16:08:51 tb Exp $ */
+/* $OpenBSD: cms_att.c,v 1.11 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -66,12 +66,14 @@ CMS_signed_get_attr_count(const CMS_SignerInfo *si)
 {
 	return X509at_get_attr_count(si->signedAttrs);
 }
+LCRYPTO_ALIAS(CMS_signed_get_attr_count);
 
 int
 CMS_signed_get_attr_by_NID(const CMS_SignerInfo *si, int nid, int lastpos)
 {
 	return X509at_get_attr_by_NID(si->signedAttrs, nid, lastpos);
 }
+LCRYPTO_ALIAS(CMS_signed_get_attr_by_NID);
 
 int
 CMS_signed_get_attr_by_OBJ(const CMS_SignerInfo *si, const ASN1_OBJECT *obj,
@@ -79,18 +81,21 @@ CMS_signed_get_attr_by_OBJ(const CMS_SignerInfo *si, const ASN1_OBJECT *obj,
 {
 	return X509at_get_attr_by_OBJ(si->signedAttrs, obj, lastpos);
 }
+LCRYPTO_ALIAS(CMS_signed_get_attr_by_OBJ);
 
 X509_ATTRIBUTE *
 CMS_signed_get_attr(const CMS_SignerInfo *si, int loc)
 {
 	return X509at_get_attr(si->signedAttrs, loc);
 }
+LCRYPTO_ALIAS(CMS_signed_get_attr);
 
 X509_ATTRIBUTE *
 CMS_signed_delete_attr(CMS_SignerInfo *si, int loc)
 {
 	return X509at_delete_attr(si->signedAttrs, loc);
 }
+LCRYPTO_ALIAS(CMS_signed_delete_attr);
 
 int
 CMS_signed_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr)
@@ -99,6 +104,7 @@ CMS_signed_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr)
 		return 1;
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_signed_add1_attr);
 
 int
 CMS_signed_add1_attr_by_OBJ(CMS_SignerInfo *si, const ASN1_OBJECT *obj, int type,
@@ -108,6 +114,7 @@ CMS_signed_add1_attr_by_OBJ(CMS_SignerInfo *si, const ASN1_OBJECT *obj, int type
 		return 1;
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_signed_add1_attr_by_OBJ);
 
 int
 CMS_signed_add1_attr_by_NID(CMS_SignerInfo *si, int nid, int type,
@@ -117,6 +124,7 @@ CMS_signed_add1_attr_by_NID(CMS_SignerInfo *si, int nid, int type,
 		return 1;
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_signed_add1_attr_by_NID);
 
 int
 CMS_signed_add1_attr_by_txt(CMS_SignerInfo *si, const char *attrname, int type,
@@ -126,6 +134,7 @@ CMS_signed_add1_attr_by_txt(CMS_SignerInfo *si, const char *attrname, int type,
 		return 1;
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_signed_add1_attr_by_txt);
 
 void *
 CMS_signed_get0_data_by_OBJ(CMS_SignerInfo *si, const ASN1_OBJECT *oid,
@@ -133,18 +142,21 @@ CMS_signed_get0_data_by_OBJ(CMS_SignerInfo *si, const ASN1_OBJECT *oid,
 {
 	return X509at_get0_data_by_OBJ(si->signedAttrs, oid, lastpos, type);
 }
+LCRYPTO_ALIAS(CMS_signed_get0_data_by_OBJ);
 
 int
 CMS_unsigned_get_attr_count(const CMS_SignerInfo *si)
 {
 	return X509at_get_attr_count(si->unsignedAttrs);
 }
+LCRYPTO_ALIAS(CMS_unsigned_get_attr_count);
 
 int
 CMS_unsigned_get_attr_by_NID(const CMS_SignerInfo *si, int nid, int lastpos)
 {
 	return X509at_get_attr_by_NID(si->unsignedAttrs, nid, lastpos);
 }
+LCRYPTO_ALIAS(CMS_unsigned_get_attr_by_NID);
 
 int
 CMS_unsigned_get_attr_by_OBJ(const CMS_SignerInfo *si, const ASN1_OBJECT *obj,
@@ -152,18 +164,21 @@ CMS_unsigned_get_attr_by_OBJ(const CMS_SignerInfo *si, const ASN1_OBJECT *obj,
 {
 	return X509at_get_attr_by_OBJ(si->unsignedAttrs, obj, lastpos);
 }
+LCRYPTO_ALIAS(CMS_unsigned_get_attr_by_OBJ);
 
 X509_ATTRIBUTE *
 CMS_unsigned_get_attr(const CMS_SignerInfo *si, int loc)
 {
 	return X509at_get_attr(si->unsignedAttrs, loc);
 }
+LCRYPTO_ALIAS(CMS_unsigned_get_attr);
 
 X509_ATTRIBUTE *
 CMS_unsigned_delete_attr(CMS_SignerInfo *si, int loc)
 {
 	return X509at_delete_attr(si->unsignedAttrs, loc);
 }
+LCRYPTO_ALIAS(CMS_unsigned_delete_attr);
 
 int
 CMS_unsigned_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr)
@@ -172,6 +187,7 @@ CMS_unsigned_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr)
 		return 1;
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_unsigned_add1_attr);
 
 int
 CMS_unsigned_add1_attr_by_OBJ(CMS_SignerInfo *si, const ASN1_OBJECT *obj,
@@ -181,6 +197,7 @@ CMS_unsigned_add1_attr_by_OBJ(CMS_SignerInfo *si, const ASN1_OBJECT *obj,
 		return 1;
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_unsigned_add1_attr_by_OBJ);
 
 int
 CMS_unsigned_add1_attr_by_NID(CMS_SignerInfo *si, int nid, int type,
@@ -190,6 +207,7 @@ CMS_unsigned_add1_attr_by_NID(CMS_SignerInfo *si, int nid, int type,
 		return 1;
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_unsigned_add1_attr_by_NID);
 
 int
 CMS_unsigned_add1_attr_by_txt(CMS_SignerInfo *si, const char *attrname,
@@ -200,6 +218,7 @@ CMS_unsigned_add1_attr_by_txt(CMS_SignerInfo *si, const char *attrname,
 		return 1;
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_unsigned_add1_attr_by_txt);
 
 void *
 CMS_unsigned_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid, int lastpos,
@@ -207,5 +226,6 @@ CMS_unsigned_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid, int lastpos,
 {
 	return X509at_get0_data_by_OBJ(si->unsignedAttrs, oid, lastpos, type);
 }
+LCRYPTO_ALIAS(CMS_unsigned_get0_data_by_OBJ);
 
 /* Specific attribute cases */
diff --git a/lib/libcrypto/cms/cms_enc.c b/lib/libcrypto/cms/cms_enc.c
index 06dffcbed4a..547f9ff7430 100644
--- a/lib/libcrypto/cms/cms_enc.c
+++ b/lib/libcrypto/cms/cms_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_enc.c,v 1.22 2022/11/26 16:08:51 tb Exp $ */
+/* $OpenBSD: cms_enc.c,v 1.23 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -249,6 +249,7 @@ CMS_EncryptedData_set1_key(CMS_ContentInfo *cms, const EVP_CIPHER *ciph,
 
 	return cms_EncryptedContent_init(ec, ciph, key, keylen);
 }
+LCRYPTO_ALIAS(CMS_EncryptedData_set1_key);
 
 BIO *
 cms_EncryptedData_init_bio(CMS_ContentInfo *cms)
diff --git a/lib/libcrypto/cms/cms_env.c b/lib/libcrypto/cms/cms_env.c
index 1d534e3da58..7bb8f613a80 100644
--- a/lib/libcrypto/cms/cms_env.c
+++ b/lib/libcrypto/cms/cms_env.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_env.c,v 1.25 2022/11/26 16:08:51 tb Exp $ */
+/* $OpenBSD: cms_env.c,v 1.26 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -139,12 +139,14 @@ CMS_get0_RecipientInfos(CMS_ContentInfo *cms)
 
 	return env->recipientInfos;
 }
+LCRYPTO_ALIAS(CMS_get0_RecipientInfos);
 
 int
 CMS_RecipientInfo_type(CMS_RecipientInfo *ri)
 {
 	return ri->type;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_type);
 
 EVP_PKEY_CTX *
 CMS_RecipientInfo_get0_pkey_ctx(CMS_RecipientInfo *ri)
@@ -156,6 +158,7 @@ CMS_RecipientInfo_get0_pkey_ctx(CMS_RecipientInfo *ri)
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_get0_pkey_ctx);
 
 CMS_ContentInfo *
 CMS_EnvelopedData_create(const EVP_CIPHER *cipher)
@@ -180,6 +183,7 @@ CMS_EnvelopedData_create(const EVP_CIPHER *cipher)
 	CMSerror(ERR_R_MALLOC_FAILURE);
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_EnvelopedData_create);
 
 /* Key Transport Recipient Info (KTRI) routines */
 
@@ -288,6 +292,7 @@ CMS_add1_recipient_cert(CMS_ContentInfo *cms, X509 *recip, unsigned int flags)
 	ASN1_item_free((ASN1_VALUE *)ri, &CMS_RecipientInfo_it);
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_add1_recipient_cert);
 
 int
 CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri, EVP_PKEY **pk,
@@ -311,6 +316,7 @@ CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri, EVP_PKEY **pk,
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_ktri_get0_algs);
 
 int
 CMS_RecipientInfo_ktri_get0_signer_id(CMS_RecipientInfo *ri,
@@ -326,6 +332,7 @@ CMS_RecipientInfo_ktri_get0_signer_id(CMS_RecipientInfo *ri,
 
 	return cms_SignerIdentifier_get0_signer_id(ktri->rid, keyid, issuer, sno);
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_ktri_get0_signer_id);
 
 int
 CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert)
@@ -337,6 +344,7 @@ CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert)
 
 	return cms_SignerIdentifier_cert_cmp(ri->d.ktri->rid, cert);
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_ktri_cert_cmp);
 
 int
 CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pkey)
@@ -350,6 +358,7 @@ CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pkey)
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_set0_pkey);
 
 /* Encrypt content key in key transport recipient info */
 
@@ -522,6 +531,7 @@ CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo *ri, const unsigned char *id,
 
 	return ASN1_OCTET_STRING_cmp(&tmp_os, kekri->kekid->keyIdentifier);
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kekri_id_cmp);
 
 /* For now hard code AES key wrap info */
 
@@ -639,6 +649,7 @@ CMS_add0_recipient_key(CMS_ContentInfo *cms, int nid, unsigned char *key,
 	ASN1_item_free((ASN1_VALUE *)ri, &CMS_RecipientInfo_it);
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_add0_recipient_key);
 
 int
 CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo *ri, X509_ALGOR **palg,
@@ -673,6 +684,7 @@ CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo *ri, X509_ALGOR **palg,
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kekri_get0_id);
 
 int
 CMS_RecipientInfo_set0_key(CMS_RecipientInfo *ri, unsigned char *key,
@@ -690,6 +702,7 @@ CMS_RecipientInfo_set0_key(CMS_RecipientInfo *ri, unsigned char *key,
 	kekri->keylen = keylen;
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_set0_key);
 
 /* Encrypt content key in KEK recipient info */
 
@@ -825,6 +838,7 @@ CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
 		return 0;
 	}
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_decrypt);
 
 int
 CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
@@ -847,6 +861,7 @@ CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
 		return 0;
 	}
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_encrypt);
 
 /* Check structures and fixup version numbers (if necessary) */
 
diff --git a/lib/libcrypto/cms/cms_err.c b/lib/libcrypto/cms/cms_err.c
index 07869ff9867..5758a26db5d 100644
--- a/lib/libcrypto/cms/cms_err.c
+++ b/lib/libcrypto/cms/cms_err.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_err.c,v 1.13 2022/07/12 14:42:48 kn Exp $ */
+/* $OpenBSD: cms_err.c,v 1.14 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
  *
@@ -161,3 +161,4 @@ ERR_load_CMS_strings(void)
 #endif
 	return 1;
 }
+LCRYPTO_ALIAS(ERR_load_CMS_strings);
diff --git a/lib/libcrypto/cms/cms_ess.c b/lib/libcrypto/cms/cms_ess.c
index 88ea6e96f6c..b9a4cd8afb1 100644
--- a/lib/libcrypto/cms/cms_ess.c
+++ b/lib/libcrypto/cms/cms_ess.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_ess.c,v 1.22 2022/11/26 16:08:51 tb Exp $ */
+/* $OpenBSD: cms_ess.c,v 1.23 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -70,24 +70,28 @@ d2i_CMS_ReceiptRequest(CMS_ReceiptRequest **a, const unsigned char **in, long le
 	return (CMS_ReceiptRequest *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
 	    &CMS_ReceiptRequest_it);
 }
+LCRYPTO_ALIAS(d2i_CMS_ReceiptRequest);
 
 int
 i2d_CMS_ReceiptRequest(CMS_ReceiptRequest *a, unsigned char **out)
 {
 	return ASN1_item_i2d((ASN1_VALUE *)a, out, &CMS_ReceiptRequest_it);
 }
+LCRYPTO_ALIAS(i2d_CMS_ReceiptRequest);
 
 CMS_ReceiptRequest *
 CMS_ReceiptRequest_new(void)
 {
 	return (CMS_ReceiptRequest *)ASN1_item_new(&CMS_ReceiptRequest_it);
 }
+LCRYPTO_ALIAS(CMS_ReceiptRequest_new);
 
 void
 CMS_ReceiptRequest_free(CMS_ReceiptRequest *a)
 {
 	ASN1_item_free((ASN1_VALUE *)a, &CMS_ReceiptRequest_it);
 }
+LCRYPTO_ALIAS(CMS_ReceiptRequest_free);
 
 /* ESS services: for now just Signed Receipt related */
 
diff --git a/lib/libcrypto/cms/cms_io.c b/lib/libcrypto/cms/cms_io.c
index 38e76e0c2e4..ceb4ce8ecba 100644
--- a/lib/libcrypto/cms/cms_io.c
+++ b/lib/libcrypto/cms/cms_io.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_io.c,v 1.19 2023/04/26 14:23:18 tb Exp $ */
+/* $OpenBSD: cms_io.c,v 1.20 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -82,18 +82,21 @@ CMS_stream(unsigned char ***boundary, CMS_ContentInfo *cms)
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_stream);
 
 CMS_ContentInfo *
 d2i_CMS_bio(BIO *bp, CMS_ContentInfo **cms)
 {
 	return ASN1_item_d2i_bio(&CMS_ContentInfo_it, bp, cms);
 }
+LCRYPTO_ALIAS(d2i_CMS_bio);
 
 int
 i2d_CMS_bio(BIO *bp, CMS_ContentInfo *cms)
 {
 	return ASN1_item_i2d_bio(&CMS_ContentInfo_it, bp, cms);
 }
+LCRYPTO_ALIAS(i2d_CMS_bio);
 
 
 CMS_ContentInfo *
@@ -129,6 +132,7 @@ BIO_new_CMS(BIO *out, CMS_ContentInfo *cms)
 {
 	return BIO_new_NDEF(out, (ASN1_VALUE *)cms, &CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(BIO_new_CMS);
 
 /* CMS wrappers round generalised stream and MIME routines */
 
@@ -138,6 +142,7 @@ i2d_CMS_bio_stream(BIO *out, CMS_ContentInfo *cms, BIO *in, int flags)
 	return i2d_ASN1_bio_stream(out, (ASN1_VALUE *)cms, in, flags,
 	    &CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(i2d_CMS_bio_stream);
 
 int
 PEM_write_bio_CMS_stream(BIO *out, CMS_ContentInfo *cms, BIO *in, int flags)
@@ -145,6 +150,7 @@ PEM_write_bio_CMS_stream(BIO *out, CMS_ContentInfo *cms, BIO *in, int flags)
 	return PEM_write_bio_ASN1_stream(out, (ASN1_VALUE *)cms, in, flags,
 	    "CMS", &CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(PEM_write_bio_CMS_stream);
 
 int
 SMIME_write_CMS(BIO *bio, CMS_ContentInfo *cms, BIO *data, int flags)
@@ -159,6 +165,7 @@ SMIME_write_CMS(BIO *bio, CMS_ContentInfo *cms, BIO *data, int flags)
 	return SMIME_write_ASN1(bio, (ASN1_VALUE *)cms, data, flags, ctype_nid,
 	    econt_nid, mdalgs, &CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(SMIME_write_CMS);
 
 CMS_ContentInfo *
 SMIME_read_CMS(BIO *bio, BIO **bcont)
@@ -166,3 +173,4 @@ SMIME_read_CMS(BIO *bio, BIO **bcont)
 	return (CMS_ContentInfo *)SMIME_read_ASN1(bio, bcont,
 	    &CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(SMIME_read_CMS);
diff --git a/lib/libcrypto/cms/cms_kari.c b/lib/libcrypto/cms/cms_kari.c
index 02940077917..8ed54e7578e 100644
--- a/lib/libcrypto/cms/cms_kari.c
+++ b/lib/libcrypto/cms/cms_kari.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_kari.c,v 1.14 2022/11/26 16:08:51 tb Exp $ */
+/* $OpenBSD: cms_kari.c,v 1.15 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -81,6 +81,7 @@ CMS_RecipientInfo_kari_get0_alg(CMS_RecipientInfo *ri, X509_ALGOR **palg,
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kari_get0_alg);
 
 /* Retrieve recipient encrypted keys from a kari */
 
@@ -93,6 +94,7 @@ CMS_RecipientInfo_kari_get0_reks(CMS_RecipientInfo *ri)
 	}
 	return ri->d.kari->recipientEncryptedKeys;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kari_get0_reks);
 
 int
 CMS_RecipientInfo_kari_get0_orig_id(CMS_RecipientInfo *ri, X509_ALGOR **pubalg,
@@ -134,6 +136,7 @@ CMS_RecipientInfo_kari_get0_orig_id(CMS_RecipientInfo *ri, X509_ALGOR **pubalg,
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kari_get0_orig_id);
 
 int
 CMS_RecipientInfo_kari_orig_id_cmp(CMS_RecipientInfo *ri, X509 *cert)
@@ -152,6 +155,7 @@ CMS_RecipientInfo_kari_orig_id_cmp(CMS_RecipientInfo *ri, X509 *cert)
 
 	return -1;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kari_orig_id_cmp);
 
 int
 CMS_RecipientEncryptedKey_get0_id(CMS_RecipientEncryptedKey *rek,
@@ -187,6 +191,7 @@ CMS_RecipientEncryptedKey_get0_id(CMS_RecipientEncryptedKey *rek,
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_RecipientEncryptedKey_get0_id);
 
 int
 CMS_RecipientEncryptedKey_cert_cmp(CMS_RecipientEncryptedKey *rek, X509 *cert)
@@ -200,6 +205,7 @@ CMS_RecipientEncryptedKey_cert_cmp(CMS_RecipientEncryptedKey *rek, X509 *cert)
 	else
 		return -1;
 }
+LCRYPTO_ALIAS(CMS_RecipientEncryptedKey_cert_cmp);
 
 int
 CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk)
@@ -221,6 +227,7 @@ CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk)
 	EVP_PKEY_CTX_free(pctx);
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kari_set0_pkey);
 
 EVP_CIPHER_CTX *
 CMS_RecipientInfo_kari_get0_ctx(CMS_RecipientInfo *ri)
@@ -229,6 +236,7 @@ CMS_RecipientInfo_kari_get0_ctx(CMS_RecipientInfo *ri)
 		return ri->d.kari->ctx;
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kari_get0_ctx);
 
 /*
  * Derive KEK and decrypt/encrypt with it to produce either the original CEK
@@ -309,6 +317,7 @@ CMS_RecipientInfo_kari_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
 
 	return rv;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_kari_decrypt);
 
 /* Create ephemeral key and initialise context based on it */
 static int
diff --git a/lib/libcrypto/cms/cms_lib.c b/lib/libcrypto/cms/cms_lib.c
index f8d950de031..fa62e61e964 100644
--- a/lib/libcrypto/cms/cms_lib.c
+++ b/lib/libcrypto/cms/cms_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_lib.c,v 1.17 2023/06/11 05:35:43 tb Exp $ */
+/* $OpenBSD: cms_lib.c,v 1.18 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -69,24 +69,28 @@ d2i_CMS_ContentInfo(CMS_ContentInfo **a, const unsigned char **in, long len)
 	return (CMS_ContentInfo *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
 	    &CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(d2i_CMS_ContentInfo);
 
 int
 i2d_CMS_ContentInfo(CMS_ContentInfo *a, unsigned char **out)
 {
 	return ASN1_item_i2d((ASN1_VALUE *)a, out, &CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(i2d_CMS_ContentInfo);
 
 CMS_ContentInfo *
 CMS_ContentInfo_new(void)
 {
 	return (CMS_ContentInfo *)ASN1_item_new(&CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(CMS_ContentInfo_new);
 
 void
 CMS_ContentInfo_free(CMS_ContentInfo *a)
 {
 	ASN1_item_free((ASN1_VALUE *)a, &CMS_ContentInfo_it);
 }
+LCRYPTO_ALIAS(CMS_ContentInfo_free);
 
 int
 CMS_ContentInfo_print_ctx(BIO *out, CMS_ContentInfo *x, int indent, const ASN1_PCTX *pctx)
@@ -94,12 +98,14 @@ CMS_ContentInfo_print_ctx(BIO *out, CMS_ContentInfo *x, int indent, const ASN1_P
 	return ASN1_item_print(out, (ASN1_VALUE *)x, indent,
 	    &CMS_ContentInfo_it, pctx);
 }
+LCRYPTO_ALIAS(CMS_ContentInfo_print_ctx);
 
 const ASN1_OBJECT *
 CMS_get0_type(const CMS_ContentInfo *cms)
 {
 	return cms->contentType;
 }
+LCRYPTO_ALIAS(CMS_get0_type);
 
 CMS_ContentInfo *
 cms_Data_create(void)
@@ -182,6 +188,7 @@ CMS_dataInit(CMS_ContentInfo *cms, BIO *icont)
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_dataInit);
 
 int
 CMS_dataFinal(CMS_ContentInfo *cms, BIO *cmsbio)
@@ -228,6 +235,7 @@ CMS_dataFinal(CMS_ContentInfo *cms, BIO *cmsbio)
 		return 0;
 	}
 }
+LCRYPTO_ALIAS(CMS_dataFinal);
 
 /*
  * Return an OCTET STRING pointer to content. This allows it to be accessed
@@ -311,6 +319,7 @@ CMS_get0_eContentType(CMS_ContentInfo *cms)
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_get0_eContentType);
 
 int
 CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid)
@@ -330,6 +339,7 @@ CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid)
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_set1_eContentType);
 
 int
 CMS_is_detached(CMS_ContentInfo *cms)
@@ -344,6 +354,7 @@ CMS_is_detached(CMS_ContentInfo *cms)
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_is_detached);
 
 int
 CMS_set_detached(CMS_ContentInfo *cms, int detached)
@@ -371,6 +382,7 @@ CMS_set_detached(CMS_ContentInfo *cms, int detached)
 
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_set_detached);
 
 /* Create a digest BIO from an X509_ALGOR structure */
 
@@ -471,6 +483,7 @@ CMS_add0_CertificateChoices(CMS_ContentInfo *cms)
 
 	return cch;
 }
+LCRYPTO_ALIAS(CMS_add0_CertificateChoices);
 
 int
 CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert)
@@ -499,6 +512,7 @@ CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert)
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_add0_cert);
 
 int
 CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert)
@@ -511,6 +525,7 @@ CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert)
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_add1_cert);
 
 static STACK_OF(CMS_RevocationInfoChoice) **
 cms_get0_revocation_choices(CMS_ContentInfo *cms)
@@ -553,6 +568,7 @@ CMS_add0_RevocationInfoChoice(CMS_ContentInfo *cms)
 
 	return rch;
 }
+LCRYPTO_ALIAS(CMS_add0_RevocationInfoChoice);
 
 int
 CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl)
@@ -567,6 +583,7 @@ CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl)
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_add0_crl);
 
 int
 CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl)
@@ -579,6 +596,7 @@ CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl)
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_add1_crl);
 
 STACK_OF(X509) *
 CMS_get1_certs(CMS_ContentInfo *cms)
@@ -608,6 +626,7 @@ CMS_get1_certs(CMS_ContentInfo *cms)
 	}
 	return certs;
 }
+LCRYPTO_ALIAS(CMS_get1_certs);
 
 STACK_OF(X509_CRL) *
 CMS_get1_crls(CMS_ContentInfo *cms)
@@ -637,6 +656,7 @@ CMS_get1_crls(CMS_ContentInfo *cms)
 	}
 	return crls;
 }
+LCRYPTO_ALIAS(CMS_get1_crls);
 
 static const ASN1_OCTET_STRING *
 cms_X509_get0_subject_key_id(X509 *x)
diff --git a/lib/libcrypto/cms/cms_pwri.c b/lib/libcrypto/cms/cms_pwri.c
index 3348b60fdc0..9ea7cfdcb07 100644
--- a/lib/libcrypto/cms/cms_pwri.c
+++ b/lib/libcrypto/cms/cms_pwri.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_pwri.c,v 1.28 2022/11/26 16:08:51 tb Exp $ */
+/* $OpenBSD: cms_pwri.c,v 1.29 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -84,6 +84,7 @@ CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri, unsigned char *pass,
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_RecipientInfo_set0_password);
 
 CMS_RecipientInfo *
 CMS_add0_recipient_password(CMS_ContentInfo *cms, int iter, int wrap_nid,
@@ -213,6 +214,7 @@ CMS_add0_recipient_password(CMS_ContentInfo *cms, int iter, int wrap_nid,
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_add0_recipient_password);
 
 /*
  * This is an implementation of the key wrapping mechanism in RFC3211, at
diff --git a/lib/libcrypto/cms/cms_sd.c b/lib/libcrypto/cms/cms_sd.c
index 8df78fe3e51..89ba5bf01f0 100644
--- a/lib/libcrypto/cms/cms_sd.c
+++ b/lib/libcrypto/cms/cms_sd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_sd.c,v 1.25 2022/11/26 16:08:51 tb Exp $ */
+/* $OpenBSD: cms_sd.c,v 1.26 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -107,6 +107,7 @@ CMS_SignedData_init(CMS_ContentInfo *cms)
 	else
 		return 0;
 }
+LCRYPTO_ALIAS(CMS_SignedData_init);
 
 /* Check structures and fixup version numbers (if necessary) */
 
@@ -424,6 +425,7 @@ CMS_add1_signer(CMS_ContentInfo *cms, X509 *signer, EVP_PKEY *pk,
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_add1_signer);
 
 static int
 cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t)
@@ -459,12 +461,14 @@ CMS_SignerInfo_get0_pkey_ctx(CMS_SignerInfo *si)
 {
 	return si->pctx;
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_get0_pkey_ctx);
 
 EVP_MD_CTX *
 CMS_SignerInfo_get0_md_ctx(CMS_SignerInfo *si)
 {
 	return si->mctx;
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_get0_md_ctx);
 
 STACK_OF(CMS_SignerInfo) *
 CMS_get0_SignerInfos(CMS_ContentInfo *cms)
@@ -477,6 +481,7 @@ CMS_get0_SignerInfos(CMS_ContentInfo *cms)
 
 	return sd->signerInfos;
 }
+LCRYPTO_ALIAS(CMS_get0_SignerInfos);
 
 STACK_OF(X509) *
 CMS_get0_signers(CMS_ContentInfo *cms)
@@ -504,6 +509,7 @@ CMS_get0_signers(CMS_ContentInfo *cms)
 
 	return signers;
 }
+LCRYPTO_ALIAS(CMS_get0_signers);
 
 void
 CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer)
@@ -516,6 +522,7 @@ CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer)
 	X509_free(si->signer);
 	si->signer = signer;
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_set1_signer_cert);
 
 int
 CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid,
@@ -523,12 +530,14 @@ CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid,
 {
 	return cms_SignerIdentifier_get0_signer_id(si->sid, keyid, issuer, sno);
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_get0_signer_id);
 
 int
 CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert)
 {
 	return cms_SignerIdentifier_cert_cmp(si->sid, cert);
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_cert_cmp);
 
 int
 CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
@@ -577,6 +586,7 @@ CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
 	}
 	return ret;
 }
+LCRYPTO_ALIAS(CMS_set1_signers_certs);
 
 void
 CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer,
@@ -591,12 +601,14 @@ X509_ALGOR **pdig, X509_ALGOR **psig)
 	if (psig)
 		*psig = si->signatureAlgorithm;
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_get0_algs);
 
 ASN1_OCTET_STRING *
 CMS_SignerInfo_get0_signature(CMS_SignerInfo *si)
 {
 	return si->signature;
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_get0_signature);
 
 static int
 cms_SignerInfo_content_sign(CMS_ContentInfo *cms, CMS_SignerInfo *si, BIO *chain)
@@ -773,6 +785,7 @@ CMS_SignerInfo_sign(CMS_SignerInfo *si)
 
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_sign);
 
 int
 CMS_SignerInfo_verify(CMS_SignerInfo *si)
@@ -822,6 +835,7 @@ CMS_SignerInfo_verify(CMS_SignerInfo *si)
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_verify);
 
 /* Create a chain of digest BIOs from a CMS ContentInfo */
 
@@ -931,6 +945,7 @@ CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_SignerInfo_verify_content);
 
 int
 CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs)
@@ -947,6 +962,7 @@ CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs)
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_add_smimecap);
 
 int
 CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, int algnid, int keysize)
@@ -979,6 +995,7 @@ CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, int algnid, int keysize)
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_add_simple_smimecap);
 
 /* Check to see if a cipher exists and if so add S/MIME capabilities */
 
@@ -1015,3 +1032,4 @@ CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap)
 
 	return 1;
 }
+LCRYPTO_ALIAS(CMS_add_standard_smimecap);
diff --git a/lib/libcrypto/cms/cms_smime.c b/lib/libcrypto/cms/cms_smime.c
index e9001d0f019..b2930017fd3 100644
--- a/lib/libcrypto/cms/cms_smime.c
+++ b/lib/libcrypto/cms/cms_smime.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_smime.c,v 1.26 2023/06/11 05:35:43 tb Exp $ */
+/* $OpenBSD: cms_smime.c,v 1.27 2023/07/08 08:26:26 beck Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -170,6 +170,7 @@ CMS_data(CMS_ContentInfo *cms, BIO *out, unsigned int flags)
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_data);
 
 CMS_ContentInfo *
 CMS_data_create(BIO *in, unsigned int flags)
@@ -187,6 +188,7 @@ CMS_data_create(BIO *in, unsigned int flags)
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_data_create);
 
 int
 CMS_digest_verify(CMS_ContentInfo *cms, BIO *dcont, BIO *out, unsigned int flags)
@@ -212,6 +214,7 @@ CMS_digest_verify(CMS_ContentInfo *cms, BIO *dcont, BIO *out, unsigned int flags
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_digest_verify);
 
 CMS_ContentInfo *
 CMS_digest_create(BIO *in, const EVP_MD *md, unsigned int flags)
@@ -234,6 +237,7 @@ CMS_digest_create(BIO *in, const EVP_MD *md, unsigned int flags)
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_digest_create);
 
 int
 CMS_EncryptedData_decrypt(CMS_ContentInfo *cms, const unsigned char *key,
@@ -260,6 +264,7 @@ CMS_EncryptedData_decrypt(CMS_ContentInfo *cms, const unsigned char *key,
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_EncryptedData_decrypt);
 
 CMS_ContentInfo *
 CMS_EncryptedData_encrypt(BIO *in, const EVP_CIPHER *cipher,
@@ -288,6 +293,7 @@ CMS_EncryptedData_encrypt(BIO *in, const EVP_CIPHER *cipher,
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_EncryptedData_encrypt);
 
 static int
 cms_signerinfo_verify_cert(CMS_SignerInfo *si, X509_STORE *store,
@@ -485,6 +491,7 @@ CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs, X509_STORE *store,
 
 	return ret;
 }
+LCRYPTO_ALIAS(CMS_verify);
 
 int
 CMS_verify_receipt(CMS_ContentInfo *rcms, CMS_ContentInfo *ocms,
@@ -499,6 +506,7 @@ CMS_verify_receipt(CMS_ContentInfo *rcms, CMS_ContentInfo *ocms,
 
 	return cms_Receipt_verify(rcms, ocms);
 }
+LCRYPTO_ALIAS(CMS_verify_receipt);
 
 CMS_ContentInfo *
 CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs, BIO *data,
@@ -542,6 +550,7 @@ CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs, BIO *data,
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_sign);
 
 CMS_ContentInfo *
 CMS_sign_receipt(CMS_SignerInfo *si, X509 *signcert, EVP_PKEY *pkey,
@@ -609,6 +618,7 @@ CMS_sign_receipt(CMS_SignerInfo *si, X509 *signcert, EVP_PKEY *pkey,
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_sign_receipt);
 
 CMS_ContentInfo *
 CMS_encrypt(STACK_OF(X509) *certs, BIO *data, const EVP_CIPHER *cipher,
@@ -645,6 +655,7 @@ CMS_encrypt(STACK_OF(X509) *certs, BIO *data, const EVP_CIPHER *cipher,
 
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_encrypt);
 
 static int
 cms_kari_set1_pkey(CMS_ContentInfo *cms, CMS_RecipientInfo *ri, EVP_PKEY *pk,
@@ -743,6 +754,7 @@ CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
 
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_decrypt_set1_pkey);
 
 int
 CMS_decrypt_set1_key(CMS_ContentInfo *cms, unsigned char *key, size_t keylen,
@@ -780,6 +792,7 @@ CMS_decrypt_set1_key(CMS_ContentInfo *cms, unsigned char *key, size_t keylen,
 
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_decrypt_set1_key);
 
 int
 CMS_decrypt_set1_password(CMS_ContentInfo *cms, unsigned char *pass,
@@ -805,6 +818,7 @@ CMS_decrypt_set1_password(CMS_ContentInfo *cms, unsigned char *pass,
 
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_decrypt_set1_password);
 
 int
 CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert, BIO *dcont,
@@ -839,6 +853,7 @@ CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert, BIO *dcont,
 
 	return r;
 }
+LCRYPTO_ALIAS(CMS_decrypt);
 
 int
 CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags)
@@ -867,6 +882,7 @@ CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags)
 
 	return ret;
 }
+LCRYPTO_ALIAS(CMS_final);
 
 int
 CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out, unsigned int flags)
@@ -874,6 +890,7 @@ CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out, unsigned int flags)
 	CMSerror(CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
 	return 0;
 }
+LCRYPTO_ALIAS(CMS_uncompress);
 
 CMS_ContentInfo *
 CMS_compress(BIO *in, int comp_nid, unsigned int flags)
@@ -881,3 +898,4 @@ CMS_compress(BIO *in, int comp_nid, unsigned int flags)
 	CMSerror(CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
 	return NULL;
 }
+LCRYPTO_ALIAS(CMS_compress);
diff --git a/lib/libcrypto/comp/c_rle.c b/lib/libcrypto/comp/c_rle.c
index c2c279dc04f..7907dd83cd1 100644
--- a/lib/libcrypto/comp/c_rle.c
+++ b/lib/libcrypto/comp/c_rle.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: c_rle.c,v 1.11 2022/12/24 07:12:09 tb Exp $ */
+/* $OpenBSD: c_rle.c,v 1.12 2023/07/08 08:26:26 beck Exp $ */
 /*
  * ---------------------------------------------------------------------------
  * Patches to this file were contributed by
@@ -138,6 +138,7 @@ COMP_rle(void)
 {
 	return (&rle_method);
 }
+LCRYPTO_ALIAS(COMP_rle);
 
 static int
 rle_compress_block(COMP_CTX *ctx, unsigned char *out, unsigned int olen,
diff --git a/lib/libcrypto/comp/c_zlib.c b/lib/libcrypto/comp/c_zlib.c
index ec98b26f5c6..087e2f4c617 100644
--- a/lib/libcrypto/comp/c_zlib.c
+++ b/lib/libcrypto/comp/c_zlib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: c_zlib.c,v 1.27 2023/06/11 05:35:43 tb Exp $ */
+/* $OpenBSD: c_zlib.c,v 1.28 2023/07/08 08:26:26 beck Exp $ */
 /*
  * ---------------------------------------------------------------------------
  * Major patches to this file were contributed by
@@ -137,8 +137,10 @@ COMP_zlib(void)
 {
 	return &zlib_method_nozlib;
 }
+LCRYPTO_ALIAS(COMP_zlib);
 
 void
 COMP_zlib_cleanup(void)
 {
 }
+LCRYPTO_ALIAS(COMP_zlib_cleanup);
diff --git a/lib/libcrypto/comp/comp_err.c b/lib/libcrypto/comp/comp_err.c
index 5ec5039f80c..49c476c0237 100644
--- a/lib/libcrypto/comp/comp_err.c
+++ b/lib/libcrypto/comp/comp_err.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: comp_err.c,v 1.13 2022/12/23 23:23:02 schwarze Exp $ */
+/* $OpenBSD: comp_err.c,v 1.14 2023/07/08 08:26:26 beck Exp $ */
 /* ====================================================================
  * This file was written by Dr. Stephen Henson <steve@openssl.org>.
  * Copyright (c) 1999, 2005, 2008 The OpenSSL Project.  All rights reserved.
@@ -92,3 +92,4 @@ ERR_load_COMP_strings(void)
 	}
 #endif
 }
+LCRYPTO_ALIAS(ERR_load_COMP_strings);
diff --git a/lib/libcrypto/comp/comp_lib.c b/lib/libcrypto/comp/comp_lib.c
index 5cb2335bf59..f26edc0002b 100644
--- a/lib/libcrypto/comp/comp_lib.c
+++ b/lib/libcrypto/comp/comp_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: comp_lib.c,v 1.11 2022/12/24 07:12:09 tb Exp $ */
+/* $OpenBSD: comp_lib.c,v 1.12 2023/07/08 08:26:26 beck Exp $ */
 /*
  * ---------------------------------------------------------------------------
  * Patches to this file were contributed by
@@ -136,6 +136,7 @@ COMP_CTX_new(COMP_METHOD *meth)
 	}
 	return (ret);
 }
+LCRYPTO_ALIAS(COMP_CTX_new);
 
 void
 COMP_CTX_free(COMP_CTX *ctx)
@@ -148,6 +149,7 @@ COMP_CTX_free(COMP_CTX *ctx)
 
 	free(ctx);
 }
+LCRYPTO_ALIAS(COMP_CTX_free);
 
 int
 COMP_compress_block(COMP_CTX *ctx, unsigned char *out, int olen,
@@ -165,6 +167,7 @@ COMP_compress_block(COMP_CTX *ctx, unsigned char *out, int olen,
 	}
 	return (ret);
 }
+LCRYPTO_ALIAS(COMP_compress_block);
 
 int
 COMP_expand_block(COMP_CTX *ctx, unsigned char *out, int olen,
@@ -182,3 +185,4 @@ COMP_expand_block(COMP_CTX *ctx, unsigned char *out, int olen,
 	}
 	return (ret);
 }
+LCRYPTO_ALIAS(COMP_expand_block);
diff --git a/lib/libcrypto/conf/conf_api.c b/lib/libcrypto/conf/conf_api.c
index f296e6a9629..6fe071e12ca 100644
--- a/lib/libcrypto/conf/conf_api.c
+++ b/lib/libcrypto/conf/conf_api.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_api.c,v 1.15 2015/04/11 16:03:21 deraadt Exp $ */
+/* $OpenBSD: conf_api.c,v 1.16 2023/07/08 08:26:26 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -89,6 +89,7 @@ _CONF_get_section(const CONF *conf, const char *section)
 	v = lh_CONF_VALUE_retrieve(conf->data, &vv);
 	return (v);
 }
+LCRYPTO_ALIAS(_CONF_get_section);
 
 /* Up until OpenSSL 0.9.5a, this was CONF_get_section */
 STACK_OF(CONF_VALUE) *
@@ -102,6 +103,7 @@ _CONF_get_section_values(const CONF *conf, const char *section)
 	else
 		return (NULL);
 }
+LCRYPTO_ALIAS(_CONF_get_section_values);
 
 int
 _CONF_add_string(CONF *conf, CONF_VALUE *section, CONF_VALUE *value)
@@ -125,6 +127,7 @@ _CONF_add_string(CONF *conf, CONF_VALUE *section, CONF_VALUE *value)
 	}
 	return 1;
 }
+LCRYPTO_ALIAS(_CONF_add_string);
 
 char *
 _CONF_get_string(const CONF *conf, const char *section, const char *name)
@@ -151,6 +154,7 @@ _CONF_get_string(const CONF *conf, const char *section, const char *name)
 	} else
 		return (NULL);
 }
+LCRYPTO_ALIAS(_CONF_get_string);
 
 static unsigned long
 conf_value_hash(const CONF_VALUE *v)
@@ -193,6 +197,7 @@ _CONF_new_data(CONF *conf)
 		}
 	return 1;
 }
+LCRYPTO_ALIAS(_CONF_new_data);
 
 void
 _CONF_free_data(CONF *conf)
@@ -213,6 +218,7 @@ _CONF_free_data(CONF *conf)
 	lh_CONF_VALUE_doall(conf->data, LHASH_DOALL_FN(value_free_stack));
 	lh_CONF_VALUE_free(conf->data);
 }
+LCRYPTO_ALIAS(_CONF_free_data);
 
 static void
 value_free_hash_doall_arg(CONF_VALUE *a, LHASH_OF(CONF_VALUE) *conf)
@@ -277,3 +283,4 @@ err:
 	}
 	return (v);
 }
+LCRYPTO_ALIAS(_CONF_new_section);
diff --git a/lib/libcrypto/hidden/openssl/buffer.h b/lib/libcrypto/hidden/openssl/buffer.h
new file mode 100644
index 00000000000..8dd86277f66
--- /dev/null
+++ b/lib/libcrypto/hidden/openssl/buffer.h
@@ -0,0 +1,34 @@
+/* $OpenBSD: buffer.h,v 1.1 2023/07/08 08:26:26 beck Exp $ */
+/*
+ * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_BUFFER_H
+#define _LIBCRYPTO_BUFFER_H
+
+#ifndef _MSC_VER
+#include_next <openssl/buffer.h>
+#else
+#include "../include/openssl/buffer.h"
+#endif
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(BUF_MEM_new);
+LCRYPTO_USED(BUF_MEM_free);
+LCRYPTO_USED(BUF_MEM_grow);
+LCRYPTO_USED(BUF_MEM_grow_clean);
+LCRYPTO_USED(ERR_load_BUF_strings);
+
+#endif /* _LIBCRYPTO_BUFFER_H */
diff --git a/lib/libcrypto/hidden/openssl/cms.h b/lib/libcrypto/hidden/openssl/cms.h
new file mode 100644
index 00000000000..c777e857d8f
--- /dev/null
+++ b/lib/libcrypto/hidden/openssl/cms.h
@@ -0,0 +1,146 @@
+/* $OpenBSD: cms.h,v 1.1 2023/07/08 08:26:26 beck Exp $ */
+/*
+ * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_CMS_H
+#define _LIBCRYPTO_CMS_H
+
+#ifndef _MSC_VER
+#include_next <openssl/cms.h>
+#else
+#include "../include/openssl/cms.h"
+#endif
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(CMS_ContentInfo_new);
+LCRYPTO_USED(CMS_ContentInfo_free);
+LCRYPTO_USED(d2i_CMS_ContentInfo);
+LCRYPTO_USED(i2d_CMS_ContentInfo);
+LCRYPTO_USED(CMS_ReceiptRequest_new);
+LCRYPTO_USED(CMS_ReceiptRequest_free);
+LCRYPTO_USED(d2i_CMS_ReceiptRequest);
+LCRYPTO_USED(i2d_CMS_ReceiptRequest);
+LCRYPTO_USED(CMS_ContentInfo_print_ctx);
+LCRYPTO_USED(CMS_get0_type);
+LCRYPTO_USED(CMS_dataInit);
+LCRYPTO_USED(CMS_dataFinal);
+LCRYPTO_USED(CMS_is_detached);
+LCRYPTO_USED(CMS_set_detached);
+LCRYPTO_USED(CMS_stream);
+LCRYPTO_USED(d2i_CMS_bio);
+LCRYPTO_USED(i2d_CMS_bio);
+LCRYPTO_USED(BIO_new_CMS);
+LCRYPTO_USED(i2d_CMS_bio_stream);
+LCRYPTO_USED(PEM_write_bio_CMS_stream);
+LCRYPTO_USED(SMIME_read_CMS);
+LCRYPTO_USED(SMIME_write_CMS);
+LCRYPTO_USED(CMS_final);
+LCRYPTO_USED(CMS_sign);
+LCRYPTO_USED(CMS_sign_receipt);
+LCRYPTO_USED(CMS_data);
+LCRYPTO_USED(CMS_data_create);
+LCRYPTO_USED(CMS_digest_verify);
+LCRYPTO_USED(CMS_digest_create);
+LCRYPTO_USED(CMS_EncryptedData_decrypt);
+LCRYPTO_USED(CMS_EncryptedData_encrypt);
+LCRYPTO_USED(CMS_EncryptedData_set1_key);
+LCRYPTO_USED(CMS_verify);
+LCRYPTO_USED(CMS_verify_receipt);
+LCRYPTO_USED(CMS_get0_signers);
+LCRYPTO_USED(CMS_encrypt);
+LCRYPTO_USED(CMS_decrypt);
+LCRYPTO_USED(CMS_decrypt_set1_pkey);
+LCRYPTO_USED(CMS_decrypt_set1_key);
+LCRYPTO_USED(CMS_decrypt_set1_password);
+LCRYPTO_USED(CMS_get0_RecipientInfos);
+LCRYPTO_USED(CMS_RecipientInfo_type);
+LCRYPTO_USED(CMS_RecipientInfo_get0_pkey_ctx);
+LCRYPTO_USED(CMS_EnvelopedData_create);
+LCRYPTO_USED(CMS_add1_recipient_cert);
+LCRYPTO_USED(CMS_RecipientInfo_set0_pkey);
+LCRYPTO_USED(CMS_RecipientInfo_ktri_cert_cmp);
+LCRYPTO_USED(CMS_RecipientInfo_ktri_get0_algs);
+LCRYPTO_USED(CMS_RecipientInfo_ktri_get0_signer_id);
+LCRYPTO_USED(CMS_add0_recipient_key);
+LCRYPTO_USED(CMS_RecipientInfo_kekri_get0_id);
+LCRYPTO_USED(CMS_RecipientInfo_set0_key);
+LCRYPTO_USED(CMS_RecipientInfo_kekri_id_cmp);
+LCRYPTO_USED(CMS_RecipientInfo_set0_password);
+LCRYPTO_USED(CMS_add0_recipient_password);
+LCRYPTO_USED(CMS_RecipientInfo_decrypt);
+LCRYPTO_USED(CMS_RecipientInfo_encrypt);
+LCRYPTO_USED(CMS_uncompress);
+LCRYPTO_USED(CMS_compress);
+LCRYPTO_USED(CMS_set1_eContentType);
+LCRYPTO_USED(CMS_get0_eContentType);
+LCRYPTO_USED(CMS_add0_CertificateChoices);
+LCRYPTO_USED(CMS_add0_cert);
+LCRYPTO_USED(CMS_add1_cert);
+LCRYPTO_USED(CMS_get1_certs);
+LCRYPTO_USED(CMS_add0_RevocationInfoChoice);
+LCRYPTO_USED(CMS_add0_crl);
+LCRYPTO_USED(CMS_add1_crl);
+LCRYPTO_USED(CMS_get1_crls);
+LCRYPTO_USED(CMS_SignedData_init);
+LCRYPTO_USED(CMS_add1_signer);
+LCRYPTO_USED(CMS_SignerInfo_get0_pkey_ctx);
+LCRYPTO_USED(CMS_SignerInfo_get0_md_ctx);
+LCRYPTO_USED(CMS_get0_SignerInfos);
+LCRYPTO_USED(CMS_SignerInfo_set1_signer_cert);
+LCRYPTO_USED(CMS_SignerInfo_get0_signer_id);
+LCRYPTO_USED(CMS_SignerInfo_cert_cmp);
+LCRYPTO_USED(CMS_set1_signers_certs);
+LCRYPTO_USED(CMS_SignerInfo_get0_algs);
+LCRYPTO_USED(CMS_SignerInfo_get0_signature);
+LCRYPTO_USED(CMS_SignerInfo_sign);
+LCRYPTO_USED(CMS_SignerInfo_verify);
+LCRYPTO_USED(CMS_SignerInfo_verify_content);
+LCRYPTO_USED(CMS_add_smimecap);
+LCRYPTO_USED(CMS_add_simple_smimecap);
+LCRYPTO_USED(CMS_add_standard_smimecap);
+LCRYPTO_USED(CMS_signed_get_attr_count);
+LCRYPTO_USED(CMS_signed_get_attr_by_NID);
+LCRYPTO_USED(CMS_signed_get_attr_by_OBJ);
+LCRYPTO_USED(CMS_signed_get_attr);
+LCRYPTO_USED(CMS_signed_delete_attr);
+LCRYPTO_USED(CMS_signed_add1_attr);
+LCRYPTO_USED(CMS_signed_add1_attr_by_OBJ);
+LCRYPTO_USED(CMS_signed_add1_attr_by_NID);
+LCRYPTO_USED(CMS_signed_add1_attr_by_txt);
+LCRYPTO_USED(CMS_signed_get0_data_by_OBJ);
+LCRYPTO_USED(CMS_unsigned_get_attr_count);
+LCRYPTO_USED(CMS_unsigned_get_attr_by_NID);
+LCRYPTO_USED(CMS_unsigned_get_attr_by_OBJ);
+LCRYPTO_USED(CMS_unsigned_get_attr);
+LCRYPTO_USED(CMS_unsigned_delete_attr);
+LCRYPTO_USED(CMS_unsigned_add1_attr);
+LCRYPTO_USED(CMS_unsigned_add1_attr_by_OBJ);
+LCRYPTO_USED(CMS_unsigned_add1_attr_by_NID);
+LCRYPTO_USED(CMS_unsigned_add1_attr_by_txt);
+LCRYPTO_USED(CMS_unsigned_get0_data_by_OBJ);
+LCRYPTO_USED(CMS_RecipientInfo_kari_get0_alg);
+LCRYPTO_USED(CMS_RecipientInfo_kari_get0_reks);
+LCRYPTO_USED(CMS_RecipientInfo_kari_get0_orig_id);
+LCRYPTO_USED(CMS_RecipientInfo_kari_orig_id_cmp);
+LCRYPTO_USED(CMS_RecipientEncryptedKey_get0_id);
+LCRYPTO_USED(CMS_RecipientEncryptedKey_cert_cmp);
+LCRYPTO_USED(CMS_RecipientInfo_kari_set0_pkey);
+LCRYPTO_USED(CMS_RecipientInfo_kari_get0_ctx);
+LCRYPTO_USED(CMS_RecipientInfo_kari_decrypt);
+LCRYPTO_USED(CMS_SharedInfo_encode);
+LCRYPTO_USED(ERR_load_CMS_strings);
+
+#endif /* _LIBCRYPTO_CMS_H */
diff --git a/lib/libcrypto/hidden/openssl/comp.h b/lib/libcrypto/hidden/openssl/comp.h
new file mode 100644
index 00000000000..fc97324eacb
--- /dev/null
+++ b/lib/libcrypto/hidden/openssl/comp.h
@@ -0,0 +1,37 @@
+/* $OpenBSD: comp.h,v 1.1 2023/07/08 08:26:26 beck Exp $ */
+/*
+ * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_COMP_H
+#define _LIBCRYPTO_COMP_H
+
+#ifndef _MSC_VER
+#include_next <openssl/comp.h>
+#else
+#include "../include/openssl/comp.h"
+#endif
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(COMP_CTX_new);
+LCRYPTO_USED(COMP_CTX_free);
+LCRYPTO_USED(COMP_compress_block);
+LCRYPTO_USED(COMP_expand_block);
+LCRYPTO_USED(COMP_rle);
+LCRYPTO_USED(COMP_zlib);
+LCRYPTO_USED(COMP_zlib_cleanup);
+LCRYPTO_USED(ERR_load_COMP_strings);
+
+#endif /* _LIBCRYPTO_COMP_H */
diff --git a/lib/libcrypto/hidden/openssl/conf_api.h b/lib/libcrypto/hidden/openssl/conf_api.h
new file mode 100644
index 00000000000..5ff89566164
--- /dev/null
+++ b/lib/libcrypto/hidden/openssl/conf_api.h
@@ -0,0 +1,36 @@
+/* $OpenBSD: conf_api.h,v 1.1 2023/07/08 08:26:26 beck Exp $ */
+/*
+ * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LIBCRYPTO_CONF_API_H
+#define _LIBCRYPTO_CONF_API_H
+
+#ifndef _MSC_VER
+#include_next <openssl/conf_api.h>
+#else
+#include "../include/openssl/conf_api.h"
+#endif
+#include "crypto_namespace.h"
+
+LCRYPTO_USED(_CONF_new_section);
+LCRYPTO_USED(_CONF_get_section);
+LCRYPTO_USED(_CONF_get_section_values);
+LCRYPTO_USED(_CONF_add_string);
+LCRYPTO_USED(_CONF_get_string);
+LCRYPTO_USED(_CONF_new_data);
+LCRYPTO_USED(_CONF_free_data);
+
+#endif /* _LIBCRYPTO_CONF_API_H */
-- 
2.20.1